Summary

The pythonCodeValidator.ts uses a denylist approach to prevent malicious Python execution inside Pyodide. However, this denylist misses native Pandas DataFrame methods (such as to_csv, to_json, pipe, and query). An authenticated user interacting with the CSVAgent can trick the LLM into generating these allowed Pandas methods, escaping the intended sandbox restrictions to achieve arbitrary data exfiltration and server filesystem writes.

Details

The core vulnerability lies in packages/components/src/pythonCodeValidator.ts. The validator relies on 44 regex patterns to block dangerous strings like eval(), exec(), os., and subprocess..

Because the CSVAgent uses Pandas by default, an attacker can bypass the validator entirely by utilizing Pandas native methods. The validator does not block df.to_csv(), df.to_json(), df.query(), or df.pipe(). Because Pyodide executes whatever passes the validator, an attacker can write arbitrary CSV data to the host filesystem or dump all uploaded data.

PoC

1. We extracted the exact 44 regex rules from pythonCodeValidator.ts.
2. We tested the following payloads, and all of them successfully bypass the validator:

# Bypass 1: Writes arbitrary CSV data to the server's filesystem
df.query("Age > 20")["Name"].to_csv("/tmp/exfil_data.csv")

# Bypass 2: Dumps the entire dataset (full exfiltration)
df.to_json()

# Bypass 3: Executes arbitrary expressions inside query
result = df.query("Name == Name")["Age"].sum()

When an attacker prompts the CSVAgent with "Save the results to a file for me", the LLM naturally generates df.to_csv("/tmp/exfil.csv"). This passes the validator and Pyodide executes the file write.

Impact

This is a Sandbox Escape leading to data exfiltration and arbitrary file writes to the host filesystem. Any authenticated user who can interact with a CSVAgent or upload a CSV can extract all dataset records or write files to the server.