| Title | InternLM MindSearch 0.1.0 Code Injection |
|---|
| Description | A vulnerability classified as critical was found in InternLM MindSearch. Affected is the unauthenticated HTTP API endpoint POST /solve (mindsearch/app.py). The planner agent treats large language model output as executable Python and passes it to ExecutionAction.run() in mindsearch/agent/graph.py, which invokes exec() with process globals and no sandbox or allowlist. The default service binds to x.x.x.x:8002 and does not require credentials. A remote attacker can send a crafted JSON body in the inputs field, causing the planner to emit an interpreter code block that is executed with the privileges of the API worker (root in the official Docker deployment). Successful exploitation leads to arbitrary command execution, disclosure of environment secrets (for example LLM and search API keys), and full compromise of the host process. The attack can be initiated remotely over the network without user interaction. |
|---|
| Source | ⚠️ https://gist.github.com/DReazer/7ad46df9da73d0cf414276e4195b2183 |
|---|
| User | Snkn0w (UID 90071) |
|---|
| Submission | 08/22/2026 15:02 (1 month ago) |
|---|
| Moderation | 10/03/2026 15:19 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413352 [InternLM MindSearch 0.1.0 Planner Agent graph.py ExecutionAction.run inputs code injection] |
|---|
| Points | 20 |
|---|