Agenta’s custom code evaluator uses the RestrictedPython sandbox to protect user‑supplied code. Prior to v0.48.1 the platform erroneously marked the numpy library as safe, allowing the evaluator to import numpy.ma.core.inspect. This module exposes introspection functions that give direct access to the global sys.modules dictionary, which can be exploited to invoke system commands such as os.system. The flaw matches the code injection weakness identified by CWE‑94 and facilitates arbitrary code execution. Because the attacker can run the code inside the API process, the impact is full control over the machine that hosts the API server.

The vulnerability affects the Agenta‑API component of the Agenta self‑hosted LLMOps platform. All releases before 0.48.1 are susceptible. The issue was addressed in v0.48.1 by removing numpy from the sandbox allowlist. Versions 0.60 and later replace the RestrictedPython sandbox entirely and are not affected.

The CVSS score of 8.8 highlights the high severity, and the EPSS of less than 1% indicates that the likelihood of exploitation is low at present. The flaw is not listed in the CISA KEV catalog. Nonetheless, the attack requires an authenticated user to submit code to the custom evaluator, meaning that compromised credentials or privileged access to the platform provide a direct path to arbitrary code execution. Due to the high impact and high privileges needed, sites should consider this a critical risk if they run an affected version and rely on the code evaluator feature.