title: Shell Evasion Eval and Language-Level Exec Injection
id: ATR-2026-01611
rule_version: 1
status: experimental
description: |
  Detects language-level eval/exec injection evasion techniques used when
  direct shell metacharacters would be caught. Patterns include: Ruby's
  eval("...") and Kernel.exec("..."), Python's eval()/exec()/os.system(),
  JavaScript's eval()/Function() constructor, and shell's eval statement.
  These allow arbitrary command execution through language interpreters
  rather than direct shell expansion, bypassing filters that only inspect
  for shell metacharacters like $() or backticks.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
compliance:
  owasp_llm:
    - id: LLM06:2025
      context: Language-level eval/exec injection allows arbitrary code execution bypassing shell metacharacter filters.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of eval/exec injection evasion supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 robustness and cybersecurity requirements mandate detection of adversarial inputs; language-level eval/exec constructs that achieve arbitrary code execution while bypassing shell-metacharacter filters are such an input.
      strength: primary
    - article: '14'
      context: Article 14 human oversight requires privilege-affecting actions to remain observable and controllable; eval/exec injection that runs arbitrary code outside the agent's authorised scope undermines that oversight, so detection evidence is required.
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment under Clause 6.2 must mandate input sanitization that rejects language-level execution primitives (eval, exec, system, backtick) in agent tool arguments before any interpreter or process-execution layer.
      strength: primary
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must enforce sanitization at the tool boundary so eval/exec-based evasion cannot redirect agent actions outside authorised and observable operations.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: shell-injection
  scan_target: user_input
  confidence: medium
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: (?i)\bKernel\.(?:exec|system|spawn)\s*\(["']
      description: Ruby Kernel.exec/system/spawn with string argument
    - field: tool_args
      operator: regex
      value: (?i)\bKernel\.(?:exec|system|spawn)\s*\(["']
      description: Ruby Kernel.exec/system/spawn with string argument (tool call)
    - field: user_input
      operator: regex
      value: (?i)(?:^|[^.\w])System\s*\(["'][^"']{2,}
      description: Ruby System() call with string, not the os.system/foo.System method form
    - field: tool_args
      operator: regex
      value: (?i)(?:^|[^.\w])System\s*\(["'][^"']{2,}
      description: Ruby System() call with string (tool call), not the os.system method form
    - field: user_input
      operator: regex
      value: (?i)\beval\s*\(\s*["'][^)]{0,80}?(?:\bputs\s|\bsystem\s*\(|\bexec\b|os\.system|subprocess|import\s+os|\bchr\s*\(|\bcurl\s|\bwget\s|/bin/|\brm\s+-)
      description: eval() whose string argument carries a real command-execution token (not a safe literal)
    - field: tool_args
      operator: regex
      value: (?i)\beval\s*\(\s*["'][^)]{0,80}?(?:\bputs\s|\bsystem\s*\(|\bexec\b|os\.system|subprocess|import\s+os|\bchr\s*\(|\bcurl\s|\bwget\s|/bin/|\brm\s+-)
      description: eval() in tool argument whose string carries a real command-execution token
  condition: any
  false_positives:
    - Code review agents analyzing eval usage in Python/Ruby codebases
    - Educational content about eval injection vulnerabilities
    - Legitimate dynamic code generation in authorized sandboxed environments
response:
  actions:
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01611] Language-level eval/exec injection detected. Possible
    arbitrary code execution via interpreter function. Alert raised.
confidence: 75