inclusionAI AWorld shell_tool.py subprocess.Popen os command injection

Vulnerability

Overview

A critical OS command injection vulnerability (CWE-78) has been discovered in the AWorld project by inclusionAI. The flaw resides in the file /aworld/virtual_environments/terminals/shell_tool.py, where the execute and execute_async methods employ subprocess.run() and subprocess.Popen() with the shell=True parameter. This configuration passes user-supplied input directly to the system shell without proper sanitization, enabling an attacker to inject arbitrary commands. The issue affects all versions up to commit 8c257626e648d98d793dd9a1a950c2af4dd84c4e [1][2][3][4].

Attack

Vector and Exploitation

An attacker can exploit this vulnerability by crafting malicious input strings that include shell metacharacters (e.g., ;, |, &&) appended to legitimate commands. For instance, input such as ; rm -rf / would terminate the original intended command and execute the destructive payload. The attack can be initiated remotely, although the official description rates the complexity as high and exploitation as difficult, likely due to the need for prior access to the command input interface. The exploit has been publicly disclosed, increasing the risk of active use [2][3][4].

Technical

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the AWorld process. This can lead to complete system compromise, including data exfiltration, file deletion, installation of malware, or lateral movement within the network. Because the product does not use versioning, determining the exact scope of affected deployments is challenging, but any instance using the vulnerable code is at risk [1][2].

Mitigation

Status

No official patch or version release has been provided by the vendor, as the product does not follow a versioned release model. Users should immediately review the code in shell_tool.py and either remove the shell=True parameter or replace the subprocess calls with safer alternatives (e.g., using shlex.quote() on input or switching to shell=False with a list of arguments). Until a fix is applied, access to the command input functionality should be restricted to trusted users only [2][3][4].