Skip to content

[!] Security Risk 安全漏洞 #147

@dahua966

Description

@dahua966

AgentVerse/agentverse/agents/simulation_agent/reflection.py

有多处直接使用eval处理LLM生成的内容,例如:
reaction, target = eval(
"self._" + parsed_response.return_values["output"].strip()
)

LLM生成的内容可被攻击者操纵,存在命令执行漏洞,望修补。

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions