CVE-2024-38459 (Python, published 2024-06-16T15:15Z)
Description: value: langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/langchain-ai/langchain
Files changed:
libs/experimental/langchain_experimental/agents/agent_toolkits/pandas/base.py
libs/experimental/langchain_experimental/agents/agent_toolkits/spark/base.py
libs/experimental/langchain_experimental/agents/agent_toolkits/xorbits/base.py
libs/experimental/langchain_experimental/pal_chain/base.py
libs/experimental/tests/integration_tests/chains/test_pal.py
libs/experimental/tests/unit_tests/agents/agent_toolkits/pandas/test_base.py
libs/experimental/tests/unit_tests/test_pal.py
Commit message: experimental[major]: Force users to opt-in into code that relies on the python repl (#22860)

This should make it obvious that a few of the agents in langchain
experimental rely on the python REPL as a tool under the hood, and will
force users to opt-in.

Vulnerable code:
    """Construct a Spark agent from an LLM and dataframe."""
    """Construct a xorbits agent from an LLM and dataframe."""
from langchain_experimental.pydantic_v1 import Extra, Field
    pal_chain = PALChain.from_math_prompt(llm, timeout=None)
    pal_chain = PALChain.from_colored_object_prompt(llm, timeout=None)
    create_pandas_dataframe_agent(FakeLLM(), pd.DataFrame())
    create_pandas_dataframe_agent(FakeLLM(), [pd.DataFrame(), pd.DataFrame()])
    fake_pal_chain = PALChain.from_math_prompt(fake_llm, timeout=None)
    fake_pal_chain = PALChain.from_math_prompt(fake_llm, timeout=None)
    fake_pal_chain = PALChain.from_math_prompt(fake_llm, timeout=None)
    fake_pal_chain = PALChain.from_math_prompt(fake_llm, timeout=1)
    fake_pal_chain = PALChain.from_colored_object_prompt(fake_llm, timeout=None)
    fake_pal_chain = PALChain.from_colored_object_prompt(fake_llm, timeout=None)

Fixed code:
    allow_dangerous_code: bool = False,
    Security Notice:
        This agent relies on access to a python repl tool which can execute
        arbitrary code. This can be dangerous and requires a specially sandboxed
        environment to be safely used. Failure to run this code in a properly
        sandboxed environment can lead to arbitrary code execution vulnerabilities,
        which can lead to data breaches, data loss, or other security incidents.

        Do not use this code with untrusted inputs, with elevated permissions,
        or without consulting your security team about proper sandboxing!

        You must opt-in to use this functionality by setting allow_dangerous_code=True.

        allow_dangerous_code: bool, default False
            This agent relies on access to a python repl tool which can execute
            arbitrary code. This can be dangerous and requires a specially sandboxed
            environment to be safely used.
            Failure to properly sandbox this class can lead to arbitrary code execution
            vulnerabilities, which can lead to data breaches, data loss, or
            other security incidents.
            You must opt in to use this functionality by setting
            allow_dangerous_code=True.

    if not allow_dangerous_code:
        raise ValueError(
            "This agent relies on access to a python repl tool which can execute "
            "arbitrary code. This can be dangerous and requires a specially sandboxed "
            "environment to be safely used. Please read the security notice in the "
            "doc-string of this function. You must opt-in to use this functionality "
            "by setting allow_dangerous_code=True."
            "For general security guidelines, please see: "
            "https://python.langchain.com/v0.1/docs/security/"
        )
    allow_dangerous_code: bool = False,
    """Construct a Spark agent from an LLM and dataframe.

    Security Notice:
        This agent relies on access to a python repl tool which can execute
        arbitrary code. This can be dangerous and requires a specially sandboxed
        environment to be safely used. Failure to run this code in a properly
        sandboxed environment can lead to arbitrary code execution vulnerabilities,
        which can lead to data breaches, data loss, or other security incidents.

        Do not use this code with untrusted inputs, with elevated permissions,
        or without consulting your security team about proper sandboxing!

        You must opt in to use this functionality by setting allow_dangerous_code=True.

    Args:
        allow_dangerous_code: bool, default False
            This agent relies on access to a python repl tool which can execute
            arbitrary code. This can be dangerous and requires a specially sandboxed
            environment to be safely used.
            Failure to properly sandbox this class can lead to arbitrary code execution
            vulnerabilities, which can lead to data breaches, data loss, or
            other security incidents.
            You must opt in to use this functionality by setting
            allow_dangerous_code=True.
    """
    if not allow_dangerous_code:
        raise ValueError(
            "This agent relies on access to a python repl tool which can execute "
            "arbitrary code. This can be dangerous and requires a specially sandboxed "
            "environment to be safely used. Please read the security notice in the "
            "doc-string of this function. You must opt-in to use this functionality "
            "by setting allow_dangerous_code=True."
            "For general security guidelines, please see: "
            "https://python.langchain.com/v0.1/docs/security/"
        )
    allow_dangerous_code: bool = False,
    """Construct a xorbits agent from an LLM and dataframe.

    Security Notice:
        This agent relies on access to a python repl tool which can execute
        arbitrary code. This can be dangerous and requires a specially sandboxed
        environment to be safely used. Failure to run this code in a properly
        sandboxed environment can lead to arbitrary code execution vulnerabilities,
        which can lead to data breaches, data loss, or other security incidents.

        Do not use this code with untrusted inputs, with elevated permissions,
        or without consulting your security team about proper sandboxing!

        You must opt in to use this functionality by setting allow_dangerous_code=True.

    Args:
        allow_dangerous_code: bool, default False
            This agent relies on access to a python repl tool which can execute
            arbitrary code. This can be dangerous and requires a specially sandboxed
            environment to be safely used.
            Failure to properly sandbox this class can lead to arbitrary code execution
            vulnerabilities, which can lead to data breaches, data loss, or
            other security incidents.
            You must opt in to use this functionality by setting
            allow_dangerous_code=True.
    """
    if not allow_dangerous_code:
        raise ValueError(
            "This agent relies on access to a python repl tool which can execute "
            "arbitrary code. This can be dangerous and requires a specially sandboxed "
            "environment to be safely used. Please read the security notice in the "
            "doc-string of this function. You must opt-in to use this functionality "
            "by setting allow_dangerous_code=True."
            "For general security guidelines, please see: "
            "https://python.langchain.com/v0.1/docs/security/"
        )

from langchain_experimental.pydantic_v1 import Extra, Field, root_validator
    allow_dangerous_code: bool = False
    """This chain relies on the execution of generated code, which can be dangerous.
    
    This class implements an AI technique that generates and evaluates
    Python code, which can be dangerous and requires a specially sandboxed
    environment to be safely used. While this class implements some basic guardrails
    by limiting available locals/globals and by parsing and inspecting
    the generated Python AST using `PALValidation`, those guardrails will not
    deter sophisticated attackers and are not a replacement for a proper sandbox.
    Do not use this class on untrusted inputs, with elevated permissions,
    or without consulting your security team about proper sandboxing!
    
    Failure to properly sandbox this class can lead to arbitrary code execution
    vulnerabilities, which can lead to data breaches, data loss, or other security
    incidents.
    """

    @root_validator(pre=False, skip_on_failure=True)
    def post_init(cls, values: Dict) -> Dict:
        if not values["allow_dangerous_code"]:
            raise ValueError(
                "This chain relies on the execution of generated code, "
                "which can be dangerous. "
                "Please read the security notice for this class, and only "
                "use it if you understand the security implications. "
                "If you want to proceed, you will need to opt-in, by setting "
                "`allow_dangerous_code` to `True`."
            )

        return values
    pal_chain = PALChain.from_math_prompt(llm, timeout=None, allow_dangerous_code=False)
    pal_chain = PALChain.from_colored_object_prompt(
        llm, timeout=None, allow_dangerous_code=False
    )
    with pytest.raises(ValueError):
        create_pandas_dataframe_agent(
            FakeLLM(), pd.DataFrame(), allow_dangerous_code=False
        )

    create_pandas_dataframe_agent(FakeLLM(), pd.DataFrame(), allow_dangerous_code=True)
    create_pandas_dataframe_agent(
        FakeLLM(), [pd.DataFrame(), pd.DataFrame()], allow_dangerous_code=True
    )
    fake_pal_chain = PALChain.from_math_prompt(
        fake_llm, timeout=None, allow_dangerous_code=True
    )
    fake_pal_chain = PALChain.from_math_prompt(
        fake_llm, timeout=None, allow_dangerous_code=True
    )
    fake_pal_chain = PALChain.from_math_prompt(
        fake_llm, timeout=None, allow_dangerous_code=True
    )
    fake_pal_chain = PALChain.from_math_prompt(
        fake_llm, timeout=1, allow_dangerous_code=True
    )
    fake_pal_chain = PALChain.from_colored_object_prompt(
        fake_llm, timeout=None, allow_dangerous_code=True
    )
    fake_pal_chain = PALChain.from_colored_object_prompt(
        fake_llm, timeout=None, allow_dangerous_code=True
    )