Summary
A critical code injection vulnerability in camel-ai camel allows the TerminalToolkit.shell_exec function to execute shell commands based on prompt-driven input without an approval boundary. An attacker who can influence prompts or otherwise reach this tool may cause arbitrary commands to run with the privileges of the hosting process.
Affected context
The issue occurs in camel-ai camel releases 0.2.91a1, 0.2.91a2, and 0.2.91a3 when the TerminalToolkit.shell_exec capability is exposed to prompt-driven workflows. Risk depends on whether untrusted users or content can influence tool invocation and whether the hosting process has access to sensitive files, services, or infrastructure.
Exploit preconditions
- Attack surface: The TerminalToolkit.shell_exec function or an interface that exposes it to an agent
- Required access: Ability to submit or influence prompts processed by the affected workflow
- Trigger point: A prompt-driven request that causes shell execution without a separate approval decision
- Why exploitation is possible: Prompt-derived tool actions are passed to a shell execution capability without an effective authorization boundary
Why this happens
The underlying bug is the direct connection of prompt-controlled behavior to a shell command execution function without an independent approval or authorization step. This treats generated tool input as trusted executable logic rather than untrusted data, allowing attacker-influenced content to reach command execution. The behavior maps to CWE-94: Improper Control of Generation of Code, because externally influenced input can cause executable commands to be generated or invoked.
Potential impact
- An attacker may execute arbitrary commands with the application's privileges
- Sensitive files, environment variables, or credentials could be disclosed
- Application data or local configuration could be modified or deleted
- The affected host or connected services could be compromised
- Malicious commands could enable lateral movement or operational disruption
General mitigation guidance
Mitigation generally focuses on separating natural-language intent from privileged command execution and reducing trust in generated tool arguments.
Common defensive patterns include:
- Require explicit, human-verifiable approval before executing shell commands
- Prefer narrowly scoped, allowlisted operations over general-purpose shell access
- Validate and constrain command arguments against structured schemas
- Run tools in isolated environments with minimal filesystem, network, and operating-system privileges
- Use dedicated service APIs instead of shell commands where practical
- Treat prompts, retrieved content, and model-generated arguments as untrusted input
- Apply execution time, resource, and audit controls to tool invocations
How teams detect issues like this
Organizations can look for:
- Static analysis findings where prompt or model output flows into shell execution APIs
- Code review signals showing agent tools with unrestricted command interpreters
- Missing approval, authorization, allowlisting, or argument-validation checks before tool execution
- Policies that block general-purpose shell access from untrusted agent workflows
- Runtime telemetry recording tool calls, command metadata, invoking identity, approval state, and execution results
- Automated security review rules that flag untrusted data reaching process-spawning or command-execution functions
