cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [security] `load_from_entry_points()` bypasses module prefix allowlist — any installed package can load arbitrary modules via the `cleveragents.plugins` entry-point group #6712

New issue

Open

opened 2026-04-09 23:47:24 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 23:47:24 +00:00

Owner

Bug Report: Security — Entry-Point Discovery Bypasses Module Prefix Allowlist

Severity Assessment

Impact: Any package installed in the Python environment can register a plugin via the cleveragents.plugins entry-point group and cause load_from_entry_points() to import arbitrary modules — completely bypassing the prefix allowlist that is the stated security mechanism for preventing arbitrary code execution.
Likelihood: High — any dependency with a malicious (or accidentally matching) entry-point registration in the cleveragents.plugins group would trigger this. Supply-chain attacks targeting this vector are well-known.
Priority: High

Location

File: src/cleveragents/infrastructure/plugins/loader.py
Method: PluginLoader.load_from_entry_points
Lines: 160–215

Description

PluginLoader documents a module prefix allowlist as its primary security mechanism:

"Security: All module imports are validated against a configurable prefix allowlist. Only modules whose fully-qualified name starts with an allowed prefix may be imported. This prevents arbitrary code execution from untrusted configuration."

load_class() correctly calls self._validate_module_prefix(module_path) before importing. However, load_from_entry_points() calls ep.load() directly — which imports the module and returns the class — without ever calling _validate_module_prefix():

Evidence

# src/cleveragents/infrastructure/plugins/loader.py  lines 178–208

def load_from_entry_points(
    self,
    group: str = "cleveragents.plugins",
) -> list[PluginDescriptor]:
    descriptors: list[PluginDescriptor] = []
    entry_points = importlib.metadata.entry_points()
    eps = entry_points.select(group=group)

    for ep in eps:
        try:
            ep.load()                                  # ← LOADS MODULE — NO PREFIX CHECK!
            module_path = ep.value.rsplit(":", 1)[0] if ":" in ep.value else ""
            class_name  = ep.value.rsplit(":", 1)[1] if ":" in ep.value else ep.value
            descriptor = PluginDescriptor(
                name=ep.name,
                module_path=module_path,              # stored AFTER the import already ran
                class_name=class_name,
                state=PluginState.DISCOVERED,
            )
            descriptors.append(descriptor)
            ...

Compare with load_class(), which validates the prefix before importing:

# loader.py  lines 112–130
def load_class(self, module_path: str, class_name: str) -> type[Any]:
    self._validate_module_prefix(module_path)   # ← check runs BEFORE import

    try:
        module = importlib.import_module(module_path)
    ...

Expected Behavior

load_from_entry_points() should extract the module path from ep.value, call _validate_module_prefix(module_path), and only then call ep.load() (or importlib.import_module) for entries that pass the check. Entries that fail the allowlist should be skipped with a warning.

Actual Behavior

ep.load() is called unconditionally on every discovered entry point. The allowlist is never consulted. A malicious (or accidentally matching) installed package that registers any entry point in the cleveragents.plugins group will have its module imported, executing module-level code and the class body, regardless of the configured allowed_prefixes.

Suggested Fix

for ep in eps:
    try:
        # Parse module path BEFORE loading
        if ":" not in ep.value:
            self._logger.warning("plugin.entry_point_no_class", name=ep.name, value=ep.value)
            continue

        module_path = ep.value.rsplit(":", 1)[0]
        class_name  = ep.value.rsplit(":", 1)[1]

        # Validate against allowlist BEFORE importing
        try:
            self._validate_module_prefix(module_path)
        except PluginLoadError:
            self._logger.warning(
                "plugin.entry_point_blocked",
                name=ep.name, value=ep.value, reason="prefix_not_allowed"
            )
            continue

        ep.load()   # safe to load only after validation passes
        descriptor = PluginDescriptor(
            name=ep.name,
            module_path=module_path,
            class_name=class_name,
            state=PluginState.DISCOVERED,
        )
        descriptors.append(descriptor)

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: bug-hunter

## Bug Report: Security — Entry-Point Discovery Bypasses Module Prefix Allowlist ### Severity Assessment - **Impact**: Any package installed in the Python environment can register a plugin via the `cleveragents.plugins` entry-point group and cause `load_from_entry_points()` to import **arbitrary modules** — completely bypassing the prefix allowlist that is the stated security mechanism for preventing arbitrary code execution. - **Likelihood**: High — any dependency with a malicious (or accidentally matching) entry-point registration in the `cleveragents.plugins` group would trigger this. Supply-chain attacks targeting this vector are well-known. - **Priority**: High ### Location - **File**: `src/cleveragents/infrastructure/plugins/loader.py` - **Method**: `PluginLoader.load_from_entry_points` - **Lines**: 160–215 ### Description `PluginLoader` documents a module prefix allowlist as its primary security mechanism: > "Security: All module imports are validated against a configurable prefix allowlist. Only modules whose fully-qualified name starts with an allowed prefix may be imported. This prevents arbitrary code execution from untrusted configuration." `load_class()` correctly calls `self._validate_module_prefix(module_path)` before importing. However, `load_from_entry_points()` calls **`ep.load()` directly** — which imports the module and returns the class — **without ever calling `_validate_module_prefix()`**: ### Evidence ```python # src/cleveragents/infrastructure/plugins/loader.py lines 178–208 def load_from_entry_points( self, group: str = "cleveragents.plugins", ) -> list[PluginDescriptor]: descriptors: list[PluginDescriptor] = [] entry_points = importlib.metadata.entry_points() eps = entry_points.select(group=group) for ep in eps: try: ep.load() # ← LOADS MODULE — NO PREFIX CHECK! module_path = ep.value.rsplit(":", 1)[0] if ":" in ep.value else "" class_name = ep.value.rsplit(":", 1)[1] if ":" in ep.value else ep.value descriptor = PluginDescriptor( name=ep.name, module_path=module_path, # stored AFTER the import already ran class_name=class_name, state=PluginState.DISCOVERED, ) descriptors.append(descriptor) ... ``` Compare with `load_class()`, which validates the prefix **before** importing: ```python # loader.py lines 112–130 def load_class(self, module_path: str, class_name: str) -> type[Any]: self._validate_module_prefix(module_path) # ← check runs BEFORE import try: module = importlib.import_module(module_path) ... ``` ### Expected Behavior `load_from_entry_points()` should extract the module path from `ep.value`, call `_validate_module_prefix(module_path)`, and only then call `ep.load()` (or `importlib.import_module`) for entries that pass the check. Entries that fail the allowlist should be skipped with a warning. ### Actual Behavior `ep.load()` is called unconditionally on every discovered entry point. The allowlist is never consulted. A malicious (or accidentally matching) installed package that registers any entry point in the `cleveragents.plugins` group will have its module imported, executing module-level code and the class body, regardless of the configured `allowed_prefixes`. ### Suggested Fix ```python for ep in eps: try: # Parse module path BEFORE loading if ":" not in ep.value: self._logger.warning("plugin.entry_point_no_class", name=ep.name, value=ep.value) continue module_path = ep.value.rsplit(":", 1)[0] class_name = ep.value.rsplit(":", 1)[1] # Validate against allowlist BEFORE importing try: self._validate_module_prefix(module_path) except PluginLoadError: self._logger.warning( "plugin.entry_point_blocked", name=ep.name, value=ep.value, reason="prefix_not_allowed" ) continue ep.load() # safe to load only after validation passes descriptor = PluginDescriptor( name=ep.name, module_path=module_path, class_name=class_name, state=PluginState.DISCOVERED, ) descriptors.append(descriptor) ``` ### Category security ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: `@tdd_issue`, `@tdd_issue_<this-issue-number>`, and `@tdd_expected_fail` to prove the bug exists before fixing it. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: bug-hunter

HAL9000 added the

labels

2026-04-10 00:06:07 +00:00

HAL9000 added this to the v3.2.0 milestone

2026-04-10 00:10:25 +00:00

HAL9000 referenced this issue

2026-04-10 07:27:29 +00:00

BUG-HUNT: [SECURITY] Code injection vulnerability in LangGraph function execution #7053

HAL9000 referenced this issue

2026-04-10 07:32:09 +00:00

BUG-HUNT: [SECURITY] Code injection vulnerability in LangGraph function execution #7053

HAL9000 added

and removed

labels

2026-04-14 07:20:01 +00:00

HAL9000 commented

2026-04-14 07:20:02 +00:00

Author

Owner

✅ Verified — Critical security bug: load_from_entry_points() bypasses module prefix allowlist — arbitrary module loading. MoSCoW: Must-have. Priority: Critical.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Critical security bug: load_from_entry_points() bypasses module prefix allowlist — arbitrary module loading. MoSCoW: Must-have. Priority: Critical. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor