Description
A security vulnerability exists in auto_tune_vllm/core/constraint.py where eval() is used to evaluate user-provided constraint expressions. Even with __builtins__ cleared, this approach is unsafe as crafted expressions can traverse Python's object graph to regain builtins and execute arbitrary code.
Location
- File:
auto_tune_vllm/core/constraint.py
- Lines: 22-23
- Method:
evaluate_constraint()
Action Required
Replace the unsafe use of eval() with a safe expression evaluator. Options include:
- Parse with
ast.parse() and whitelist only safe arithmetic/comparison nodes
- Use a hardened library like
asteval or numexpr
References
Description
A security vulnerability exists in
auto_tune_vllm/core/constraint.pywhereeval()is used to evaluate user-provided constraint expressions. Even with__builtins__cleared, this approach is unsafe as crafted expressions can traverse Python's object graph to regain builtins and execute arbitrary code.Location
auto_tune_vllm/core/constraint.pyevaluate_constraint()Action Required
Replace the unsafe use of
eval()with a safe expression evaluator. Options include:ast.parse()and whitelist only safe arithmetic/comparison nodesastevalornumexprReferences