Arbitrary Code Execution via Unvalidated agent path in API Endpoints
Arbitrary Code Execution via Unvalidated agent path in API Endpoints: a task in LegoFlow-SWE (Harbor dataset). Several server endpoints accept an agent path parameter from untrusted clients and pass it directly into Python's module import machinery without any validation. Because Python executes…
The task
Several server endpoints accept an `agent_path` parameter from untrusted clients and pass it directly into Python's module import machinery without any validation. Because Python executes module-level code at import time, an attacker with the ability to place a malicious Python file anywhere on the filesystem can…
Part of Lego-X/LegoFlow-SWE.