Vulnerable code sample

import os
from flask import Flask, request, jsonify

# Vulnerable tool using eval() as described in the CVE
def calculate(expression: str):
    """
    A tool that uses Python's eval() to calculate an expression.
    WARNING: This is insecure and executes arbitrary code.
    """
    try:
        # The core of the vulnerability is using eval() on unauthenticated, remote input
        result = eval(expression)
        return {"result": result}
    except Exception as e:
        return {"error": str(e)}

# Simplified representation of an agent with the unsafe tool
class VulnerableAgent:
    def __init__(self):
        # The agent has the unsafe tool registered and available for use
        self.tools = {
            "calculate": calculate
        }

    def chat(self, message: str):
        """
        Simulates an LLM being prompted to use the 'calculate' tool.
        An attacker crafts a message to trick the LLM into calling the tool
        with a malicious payload.
        """
        # For this PoC, a simple trigger simulates the LLM's tool-use decision
        if message.strip().lower().startswith("calculate"):
            # The agent extracts the payload for the tool from the message
            expression_to_eval = message.strip()[len("calculate"):].strip()
            # The agent invokes the registered tool, which is the unsafe 'calculate' function
            return self.tools["calculate"](expression_to_eval)
        else:
            return {"response": "I can only calculate. Please start your message with 'calculate'."}

# The example A2A server from the vulnerability description
app = Flask(__name__)
agent = VulnerableAgent()

@app.route('/a2a', methods=['POST'])
def a2a_rpc_endpoint():
    """
    The unauthenticated A2A JSON-RPC endpoint.
    """
    data = request.get_json()

    # The attack vector: a "message/send" request
    if data.get("method") == "message/send" and "params" in data:
        user_message = data.get("params", {}).get("message")
        if user_message:
            # The request reaches agent.chat(), which can lead to tool invocation
            response = agent.chat(user_message)
            return jsonify(response)

    return jsonify({"error": "Invalid request format"}), 400

if __name__ == '__main__':
    # The server binds to 0.0.0.0, exposing the vulnerable endpoint to the network
    # This is a key part of the vulnerability, allowing remote access.
    app.run(host='0.0.0.0', port=1337)