| タイトル | InternLM MindSearch 0.1.0 Code Injection |
|---|
| 説明 | A vulnerability classified as critical was found in InternLM MindSearch. Affected is the unauthenticated HTTP API endpoint POST /solve (mindsearch/app.py). The planner agent treats large language model output as executable Python and passes it to ExecutionAction.run() in mindsearch/agent/graph.py, which invokes exec() with process globals and no sandbox or allowlist. The default service binds to x.x.x.x:8002 and does not require credentials. A remote attacker can send a crafted JSON body in the inputs field, causing the planner to emit an interpreter code block that is executed with the privileges of the API worker (root in the official Docker deployment). Successful exploitation leads to arbitrary command execution, disclosure of environment secrets (for example LLM and search API keys), and full compromise of the host process. The attack can be initiated remotely over the network without user interaction. |
|---|
| ソース | ⚠️ https://gist.github.com/DReazer/7ad46df9da73d0cf414276e4195b2183 |
|---|
| ユーザー | Snkn0w (UID 90071) |
|---|
| 送信 | 2026年08月22日 15:02 (1 月 ago) |
|---|
| モデレーション | 2026年10月03日 15:19 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413352 [InternLM MindSearch 0.1.0 Planner Agent graph.py ExecutionAction.run inputs 特権昇格] |
|---|
| ポイント | 20 |
|---|