Potential Prompt Injection Leading to Arbitrary Code Execution via `exec`

[Doria77486]

Desciption

The following two functions directly execute agent-generated Python code using exec:

• ai_data_science_team.templates.agent_templates.node_func_execute_agent_code_on_data
• ai_data_science_team.templates.agent_templates.node_func_execute_agent_from_sql_connection

If an attacker can influence the agent prompt, agent output, or load an untrusted prompt/template, this may lead to prompt injection and ultimately arbitrary code execution (RCE) on the host system.

def node_func_execute_agent_code_on_data(
    state: Any, 
    data_key: str, 
    code_snippet_key: str, 
    ...
) -> Dict[str, Any]:
 
    print("    * EXECUTING AGENT CODE")
    # codes ...
    # Execute the code snippet to define the agent function
    local_vars = {}
    global_vars = {}
    exec(agent_code, global_vars, local_vars)  

Mitigations

Dynamic code execution via exec on untrusted input should be avoided whenever possible. If dynamic execution is necessary, strict security measures must be implemented, including parsing and validating the code with AST to allow only safe syntax nodes, built-in functions, and importable modules; alternatively, a whitelist mechanism can be used to strictly control allowed operations.