Vulnerable code sample

import ast
import json
from typing import Dict

# Simplified representation of a component validation process
class AgenticAssistantValidator:
    def __init__(self):
        # In a real scenario, this might hold context, approved modules, etc.
        self.validation_context = {}

    def validate_component(self, component_config: Dict) -> Dict:
        """
        Validates a dynamically generated component for an agent.
        The component's 'validation_code' is provided by an LLM.
        """
        validation_code = component_config.get("validation_code")

        if not validation_code:
            return {"status": "success", "message": "No validation code to run."}

        try:
            # The backend executes the LLM-generated code to check for its validity.
            # An attacker can influence the LLM to generate malicious code.
            # VULNERABLE: Unsandboxed execution of LLM-generated code during validation.
            exec(validation_code, {"__builtins__": {}}, self.validation_context)
            status = "success"
            message = "Component validation script executed successfully."
        except Exception as e:
            status = "error"
            message = f"Component validation failed: {str(e)}"

        return {"status": status, "message": message}