Langroid has WAF Bypass Leading to RCE in TableChatAgent

@@ -237,6 +237,16 @@ def visit_Subscript(self, node: ast.Subscript) -> None:
             raise UnsafeCommandError("subscript must be literal")
         self.generic_visit(node)
 
+    # Attribute access
+    def visit_Attribute(self, node: ast.Attribute) -> None:
+        # Block dunder attributes to prevent access to __init__, __globals__, etc.
+        if node.attr.startswith("__") and node.attr.endswith("__"):
+            raise UnsafeCommandError(f"dunder attribute '{node.attr}' not allowed")
+        # Block single underscore private attributes as well for defense in depth
+        if node.attr.startswith("_") and node.attr not in WHITELISTED_DF_METHODS:
+            raise UnsafeCommandError(f"private attribute '{node.attr}' not allowed")
+        self.generic_visit(node)
+
     # Method calls
     def visit_Call(self, node: ast.Call) -> None:
         if not isinstance(node.func, ast.Attribute):
@@ -253,6 +263,7 @@ def visit_Call(self, node: ast.Call) -> None:
         for kw in node.keywords:
             if kw.arg in BLOCKED_KW:
                 raise UnsafeCommandError(f"kwarg '{kw.arg}' is blocked")
+            # Check numeric limits on literals; non-literals validated via generic_visit
             _literal_ok(kw.value)
         for arg in node.args:
             _literal_ok(arg)

@@ -40,6 +40,29 @@
         r"unexpected variable 'other_var'",
     ),
     (DEEP_EXPR, r"AST nesting too deep"),
+    # CVE-2025-46724 bypass tests - dunder attribute access
+    ("df.__init__", r"dunder attribute '__init__' not allowed"),
+    ("df.__class__", r"dunder attribute '__class__' not allowed"),
+    ("df.__globals__", r"dunder attribute '__globals__' not allowed"),
+    ("df.__builtins__", r"dunder attribute '__builtins__' not allowed"),
+    # CVE-2025-46724 bypass tests - private attribute access
+    ("df._private", r"private attribute '_private' not allowed"),
+    ("df._internal_method()", r"method '_internal_method' not permitted"),
+    # CVE-2025-46724 bypass tests - dunder access via kwargs (the actual bypass vector)
+    (
+        "df.groupby(by=df.__init__)",
+        r"dunder attribute '__init__' not allowed",
+    ),
+    (
+        "df.groupby(by=df.__class__.__bases__)",
+        r"dunder attribute '__.+__' not allowed",
+    ),
+    # Full PoC exploit payload - blocks on dunder attribute access
+    (
+        "df.add_prefix(\"__import__('os').system('ls')#\").T.groupby("
+        "by=df.__init__.__globals__['__builtins__']['eval'])",
+        r"dunder attribute '__.+__' not allowed",
+    ),
 ]