Code Injection via eval() Sandbox Escape in Routing Rules

mercure is an open-source DICOM orchestration platform; we appreciate the maintainers' prompt, constructive response to this report. The routing engine decides where each incoming DICOM series goes by evaluating administrator-defined rule expressions.

Those expressions are evaluated with Python's eval(), sandboxed only by an empty builtins mapping:

safe_eval_cmds = {"float": float, "int": int, "str": str, "len": len, "bool": bool,
                  "sum": sum, "round": round, "max": max, "min": min, "abs": abs,
                  "pow": pow, "chr": chr, "ord": ord}

def eval_rule(rule: str, tags_dict: Dict[str, str]) -> Any:
    # ...
    rule = replace_tags(rule, tags_dict)
    # ...
    tags_obj = Tags(tags_dict)
    result = eval(rule, {"__builtins__": {}}, {**safe_eval_cmds, "tags": tags_obj})
    # ...
    return result, tags_obj.tags_accessed()

An empty __builtins__ removes direct access to built-in functions, but it does not stop object traversal: from any literal one can reach the base object class, enumerate its subclasses, and reach a class that exposes the real import machinery, regaining __import__ and arbitrary command execution. The vendor's own 0.4.1 release notes describe this as "trivially bypassed via MRO class traversal." We are not publishing a working payload.

The rule field reaches the evaluator without validation. HTML sanitization is applied to the tags field but not to the rule field:

testrule = form["rule"]  # raw form input, no validation
testvalues = json.loads(form["testvalues"])
result, attrs_accessed = rule_evaluation.eval_rule(testrule, testvalues)

Two paths reach the sink. /rules/test evaluates the expression immediately and returns the result in the HTTP response, so command output and file contents come straight back to the caller. A rule saved via /rules/edit/{rule} persists in mercure.json and runs on every DICOM series the router evaluates, giving persistent execution.

Evaluation runs inside the web interface process (immediate path) or the router process (saved path), so execution reaches the shared filesystem, Redis, and the rest of the Docker network. The scope-change metric reflects that.

Command execution as the mercure user is confirmed by the returned output of an injected id:

uid=1000(mercure) gid=1000(mercure) groups=1000(mercure)