Summary
A critical code injection vulnerability in InternLM MindSearch allows attacker-controlled input supplied to the Planner Agent's execution flow to be interpreted as executable code. Because the affected function can be reached remotely, a successful attack may enable arbitrary code execution in the service context.
Affected context
The issue affects InternLM MindSearch 0.1.0 when the Planner Agent invokes ExecutionAction.run in mindsearch/agent/graph.py and processes externally influenced inputs. Deployments are at greater risk when planner requests or agent inputs can be submitted remotely and are passed into execution logic without strict separation between data and code.
Exploit preconditions
- Attack surface: The remotely reachable Planner Agent execution workflow
- Required access: Ability to submit or influence inputs accepted by the affected service; authentication requirements depend on deployment configuration
- Trigger point: Processing of the
inputsargument byExecutionAction.run - Why exploitation is possible: Attacker-controlled data may reach a code-execution path without adequate validation, escaping, or separation from executable expressions
Why this happens
The underlying bug is an unsafe interpretation of externally influenced input as executable logic. When application data is incorporated into dynamic execution behavior instead of being treated strictly as data, specially formed input may alter the intended operation and cause unintended code execution. This maps primarily to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, with a related relationship to CWE-94: Improper Control of Generation of Code.
Potential impact
- An attacker may execute arbitrary code with the privileges of the MindSearch process.
- The service could be compromised or disrupted.
- Sensitive prompts, configuration, credentials, or generated results could be exposed.
- An attacker could use the compromised process for lateral movement or data manipulation.
General mitigation guidance
Mitigation generally focuses on eliminating dynamic code interpretation of untrusted input and reducing the trust placed in agent-generated or externally supplied values.
Common defensive patterns include:
- Replacing dynamic execution with explicit, allowlisted operations and structured arguments.
- Treating planner inputs as data and enforcing strict schemas, types, length limits, and character constraints.
- Separating agent planning from privileged execution through a narrowly scoped action interface.
- Running the service with least-privilege permissions, isolated credentials, and restricted network access.
- Applying sandboxing and resource limits to any unavoidable execution functionality.
- Ensuring validation occurs before inputs reach interpreters, evaluators, templates, or command-building logic.
How teams detect issues like this
Detection efforts can include:
- Static analysis for
eval,exec, dynamic imports, shell invocation, template evaluation, and indirect interpreter calls involving request or agent data. - Code review checks for planner outputs or function arguments being concatenated into executable expressions.
- Tests that submit type-invalid, boundary, and metacharacter-containing inputs to confirm they remain data.
- Runtime monitoring for unexpected child processes, command interpreters, filesystem changes, or outbound connections from the MindSearch service.
- Policy enforcement requiring allowlisted actions and forbidding dynamic execution in remotely reachable code paths.
Automated code-review and application-security tools may help identify suspicious data-to-code flows, but findings should be validated against the application's execution model.
