Security: eval() on marketplace data and LLM output enables code injection

[lighthousekeeper1212]

Security Concerns

Two separate code injection vulnerabilities found during security audit:

1. eval() on Marketplace-Sourced Data (Supply Chain Risk)

File: superagi/controllers/knowledges.py

The vector_ids field from marketplace-sourced knowledge is evaluated with eval() during knowledge uninstall operations. A malicious marketplace knowledge package could contain crafted vector_ids that execute arbitrary code when the knowledge is uninstalled.

Additionally, agent configurations (goal, instruction, constraints) are processed with eval():

• superagi/helper/resource_helper.py

Fix: Replace eval() with json.loads() or ast.literal_eval().

2. eval() on LLM Output in Task Processing

Files:

• superagi/jobs/agent_executor.py - output_handler.py:149,180 - eval(assistant_reply) on LLM response
• superagi/lib/queue_step_handler.py:79 - eval(assistant_reply) for task queue

The JsonCleaner used before eval() provides no real sanitization - it just extracts text between [ and ] brackets. An indirect prompt injection in processed data could cause the LLM to generate malicious Python code that gets executed.

Example payload: [__import__('os').system('id')]

Fix: Replace eval() with json.loads():

import json
tasks = json.loads(assistant_reply)

Note

I attempted to use GitHub's private vulnerability reporting but it appears to be disabled for this repository. Consider enabling it at Settings → Code security → Private vulnerability reporting.

---

Discovered during security audit by Lighthouse Research Project (https://lighthouse1212.com)

[xXMrNidaXx]

Critical find! eval() on untrusted data is always dangerous.

Quick fixes:

# Replace ALL eval() calls with:
import json
import ast

# For JSON data:
data = json.loads(untrusted_string)

# For Python literals only (still safer):
data = ast.literal_eval(untrusted_string)

For the LLM output case, add strict validation:

def safe_parse_tasks(llm_output: str) -> list:
    try:
        tasks = json.loads(llm_output)
        if not isinstance(tasks, list):
            raise ValueError("Expected list")
        return [str(t) for t in tasks]  # Coerce to strings
    except json.JSONDecodeError:
        return []

⚠️ This should be a security advisory — recommend enabling private vulnerability reporting.

---

Great security audit! 🎯 Security-focused developers:

https://www.revolutionai.io/find-work

Production AI projects • Great rates 💼