T08 · Insecure Dependencies
Error
- Location
- evals/run_evals.py:7
- Finding
- Unverified External Python Module Import Enables Arbitrary Code Execution## Vulnerability Details **File Location**: `evals/run_evals.py:7-10` **Vulnerability Type**: Unsafe external dependency loading through Python path manipulation **Risk Level**: High **Vulnerable Code**: ```python REPO_ROOT = Path(__file__).resolve().parent.parent.parent.parent sys.path.insert(0, str(REPO_ROOT / "shared")) from eval_framework import main ``` ### Technical Analysis The evaluation runner computes a directory outside the audited project, prepends its `shared` subdirectory to `sys.path`, and imports `eval_framework` from that search path. Python executes a module's top-level code when importing it. The imported dependency is not included in the audited project and is not constrained by a package version, trusted installation location, lockfile, signature, or cryptographic integrity check. Prepending the directory gives it priority over later module search locations. Consequently, a malicious or compromised `eval_framework.py` or equivalent importable package in the computed `shared` directory would execute automatically when the evaluation runner starts. Exploitation requires an attacker to control or modify the external `shared` directory or its deployment contents. The audit did not establish that this directory is attacker-writable, so this prerequisite is environment-dependent. ### Attack Path 1. The attacker gains write access to the `shared` directory derived four parent levels above `evals/run_evals.py`. 2. The attacker creates or replaces `eval_framework.py`, or an equivalent importable `eval_framework` package, with malicious top-level Python code. 3. A user or automated service executes `python evals/run_evals.py`. 4. The script inserts the attacker-controlled directory at index zero of `sys.path`. 5. Python resolves `from eval_framework import main` to the attacker's module. 6. The malicious top-level code executes with the privileges and environment of the evaluation process before `main() ...[truncated 586 chars]
- Remediation
- ## Remediation Suggestions 1. Package `eval_framework` as a normal, trusted dependency and pin its exact version and hashes in a lockfile or requirements file. 2. Prefer an audited dependency installed into an isolated virtual environment rather than modifying `sys.path` at runtime. 3. If the framework is project-specific, vendor its reviewed source within the repository and import it through an explicit package structure. 4. If loading from an external directory is unavoidable: - Resolve and validate the canonical module path before execution. - Restrict the source directory to a trusted, administrator-controlled location. - Verify the module against a cryptographic digest or signature. - Reject symlinks and unexpected package layouts where applicable. 5. Run the evaluator in a least-privileged sandbox with no unnecessary credentials, restricted filesystem access, and limited network access. 6. Add CI checks that fail when imports resolve outside approved dependency roots.