title: Remote Code Execution via eval() and Dynamic Code Injection
id: ATR-2026-00110
rule_version: 1
status: experimental
description: |
  Detects tools or agent instructions that invoke eval(), Function(), vm.runInNewContext(),
  or similar dynamic code execution primitives. These functions allow arbitrary code execution
  within the agent runtime, enabling an attacker to break out of sandboxed tool contexts,
  access the host process, or pivot to child_process for full system compromise.
author: ATR Community
date: 2026/03/26
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_agentic:
    - ASI05:2026
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
  owasp_llm:
    - LLM06:2025
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
compliance:
  eu_ai_act:
    - article: '15'
      context: eval() and dynamic code execution primitives allow attackers to execute arbitrary code within the agent runtime, enabling complete host system compromise; Article 15 cybersecurity requirements mandate that high-risk AI systems prohibit or strictly control dynamic code evaluation capabilities.
      strength: primary
    - article: '14'
      context: Arbitrary code execution via eval injection can override safety controls and execute actions that bypass all human oversight mechanisms; Article 14 requires that AI system architectures prevent such unrestricted capability access from agent tool layers.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: eval() and dynamic code execution primitives are adversarial input vectors that allow attackers to escape the agent's sandboxed tool context and execute arbitrary code within the host process, and must be tracked as critical AI system risks.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans must prohibit or strictly sandbox dynamic code evaluation capabilities in agent tool layers to prevent eval injection from enabling full host system compromise.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Remote Code Execution via eval() and Dynamic Code Injection).
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment activities must classify dynamic code execution via eval() and similar primitives as an unacceptable risk in AI agent tools and require architectural controls that block their use with user-controlled inputs.
      strength: primary
    - clause: '8.1'
      context: Operational controls must prohibit agent tools from invoking eval(), new Function(), or vm module methods on untrusted inputs to ensure that code execution remains within the auditable and authorized scope of the AI system.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: eval-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: tool_call
  framework:
    - mcp
    - langchain
    - llamaindex
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)eval\s*\(
      description: Direct eval() invocation for dynamic code execution
    - field: content
      operator: regex
      value: (?i)new\s+Function\s*\(
      description: new Function() constructor used to compile and execute arbitrary code
    - field: content
      operator: regex
      value: (?i)vm\.(runIn|createContext|compileFunction)
      description: Node.js vm module methods for running code in isolated or shared contexts
    - field: content
      operator: regex
      value: (?i)require\s*\(\s*['"]child_process['"]
      description: Requiring child_process module for shell command execution
    - field: content
      operator: regex
      value: (?i)import\s*\(\s*['"]child_process
      description: Dynamic import of child_process module
    - field: content
      operator: regex
      value: (?i)(?:process\.binding|Reflect\.construct\s*\(\s*Function)
      description: Low-level process binding or Reflect.construct with Function for sandbox escape
  condition: any
  false_positives:
    - Security documentation describing eval injection risks
    - Code review tools that scan for eval usage
    - Educational coding tutorials that include inline code snippets demonstrating eval() usage in a teaching context
    - Automated code review reports that quote flagged source lines containing eval() or require('child_process') verbatim
response:
  actions:
    - block_tool
    - alert
    - snapshot
confidence: 65
wild_validated: 2026/04/08
wild_samples: 53577