Security: Unsandboxed exec() with pre-injected os/sys modules in PyInterpreter

The PyInterpreter.execute() method in sources/tools/PyInterpreter.py runs LLM-generated Python code via exec() with no sandboxing and no input validation. The os and sys modules are explicitly pre-injected into the execution namespace, and full __builtins__ are available:

global_vars = {
    '__builtins__': __builtins__,
    'os': os,
    'sys': sys,
    '__name__': '__main__'
}

This gives LLM-generated code immediate access to os.system(), os.popen(), open(), subprocess, and all other Python capabilities. The optional safety flag defaults to False.

An attacker can achieve arbitrary code execution on the host through prompt injection, gaining full access to the file system, environment variables, and system commands.

All versions are affected.

Recommendation: Remove os and sys from the execution namespace, restrict __builtins__ to safe functions only, and ideally use container-based isolation (Docker, E2B, etc.) for code execution.

This project does not currently have a security policy or SECURITY.md. We recommend enabling GitHub Security Advisories so that vulnerabilities can be reported privately.

Credit: @CFionaBF