title: SuperAGI Output Handler eval() RCE (CVE-2024-21552)
id: ATR-2026-00432
rule_version: 2
status: experimental
description: |
  Detects exploitation of CVE-2024-21552 (CVSS 9.8), arbitrary code execution in all versions of SuperAGI. The vulnerable sink is `eval()` in `superagi/agent/output_handler.py` (lines 149 and 180); attacker induces the LLM to emit Python code in a position where output_handler subsequently passes it to eval(), gaining unauthenticated RCE on the SuperAGI host. This rule detects the LLM-output payload patterns that reach that sink: Python interpreter calls combined with process-spawning or filesystem APIs inside content fields a SuperAGI agent is likely to evaluate. CWE-94.
author: ATR Community
date: 2026/05/10
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM05:2025
  owasp_agentic:
    - ASI05:2026
    - ASI06:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
    - AML.T0051 - LLM Prompt Injection
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1059.006 - Python
  cve:
    - CVE-2024-21552
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2024-21552 SuperAGI output_handler.py invokes eval() on LLM-generated content unsanitised; Article 15 cybersecurity requirements mandate that high-risk AI systems neutralise interpreter sinks reachable from model output.
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate LLM-output-to-eval as a high-risk vector — model output is untrusted input from a security perspective and must not be passed to dynamic-evaluation primitives.
      strength: primary
    - article: '14'
      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the agent-manipulation technique (SuperAGI Output Handler eval() RCE (CVE-2024-21552)) would bypass or undermine that oversight.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Adversarial inputs designed to make the LLM emit Python code that downstream code passes to eval() must be tracked and detected as a primary input-attack class.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans under MG.2.3 must require static analysis flagging eval() / exec() / compile() consuming LLM output, regardless of perceived sanitisation.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (SuperAGI Output Handler eval() RCE (CVE-2024-21552)).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must prohibit dynamic-evaluation primitives (eval, exec, Function constructor) being reached by any LLM-generated content path.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the agent-manipulation technique (SuperAGI Output Handler eval() RCE (CVE-2024-21552)) is such a treatment.
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: llm-output-eval-rce
  scan_target: both
  confidence: high
agent_source:
  type: llm_io
  framework:
    - superagi
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Legitimate Python educational content discussing eval() safety best practices.
    - Static analysis output reporting eval() usage in code review tooling.
    - Documentation of CVE-2024-21552 written for defensive purposes.
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:^|[^a-zA-Z_])eval\s*\(\s*(?:["\x27]\s*)?(?:__import__|os\.system|os\.popen|subprocess\.|os\.exec|exec\s*\()
      description: eval() invoking Python OS-execution primitives — direct LLM-output-to-eval RCE signature
    - field: content
      operator: regex
      value: (?i)(?:^|[^a-zA-Z_])exec\s*\(\s*[rbu]{0,2}["\x27][^"\x27\n]{0,200}(?:__import__\s*\(\s*\\?["\x27]?(?:os|subprocess|socket)|import\s+(?:os|subprocess|socket)|os\.system|subprocess\.\w)
      description: exec() called on a string literal that imports process or socket modules; the argument must open with a quote, so lists of dangerous patterns do not match
    - field: content
      operator: regex
      value: (?i)__import__\s*\(\s*["\x27](?:os|subprocess|socket|pty|ctypes|builtins)["\x27]\s*\)\.(?:system|popen|run|call|check_output|fork|fdopen)
      description: __import__ of dangerous module followed by execution method — eval-friendly RCE chain
    - field: content
      operator: regex
      value: (?i)compile\s*\([\s\S]{2,500}?(?:os\.system|subprocess|__import__)[\s\S]{0,500}?["\x27]exec["\x27]\s*\)
      description: compile() producing exec-mode bytecode containing OS-execution — eval-compile RCE chain
    - field: content
      operator: regex
      value: (?i)superagi[^\n]{0,80}output[_\s]?handler[^\n]{0,200}(?:eval|rce|inject|bypass|exec|line\s*1[48]0)
      description: Skill/payload referencing SuperAGI output_handler eval sink with attack framing — CVE-2024-21552 explicit
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00432] CRITICAL: SuperAGI-class LLM-output-to-eval RCE pattern detected (CVE-2024-21552, CVSS 9.8). Tool response contains Python interpreter primitives (eval / exec / __import__ / compile) wrapping OS-execution APIs — the documented sink at superagi/agent/output_handler.py lines 149/180. Refuse to forward this output to any dynamic-evaluation primitive; block downstream code paths until reviewed.
confidence: 84