CVE-2026-54769: Langroid TableChatAgent Sandbox Escape via eval() RCE

let LangroidRCEIndicators = dynamic(['__import__', '__builtins__', 'os.system', 'subprocess', 'eval(', 'exec(', '__class__.__mro__', '__subclasses__', 'open(', 'importlib']);
let SuspiciousCommands = dynamic(['curl', 'wget', 'nc ', 'bash', 'sh -c', 'python -c', 'cmd.exe', 'powershell']);
union
(
  AzureDiagnostics
  | where ResourceProvider == "MICROSOFT.WEB" or Category == "AppServiceHTTPLogs"
  | where csUriStem has_any ("/chat", "/agent", "/query", "/ask")
  | where csUriQuery has_any (LangroidRCEIndicators)
  | project TimeGenerated, Resource, csUriStem, csUriQuery, csMethod, scStatus, clientIp_s
),
(
  CommonSecurityLog
  | where DeviceVendor == "Python" or ApplicationProtocol == "HTTP"
  | where RequestURL has_any ("/chat", "/agent", "/query")
  | where Message has_any (LangroidRCEIndicators)
  | project TimeGenerated, DeviceAddress, RequestURL, Message, DestinationIP
),
(
  Syslog
  | where ProcessName in ("python", "python3", "uvicorn", "gunicorn", "fastapi")
  | where SyslogMessage has_any (LangroidRCEIndicators)
  | project TimeGenerated, HostName, ProcessName, SyslogMessage
),
(
  SecurityEvent
  | where EventID in (4688, 4689)
  | where ParentProcessName has_any ("python.exe", "python3.exe", "uvicorn.exe")
  | where CommandLine has_any (SuspiciousCommands)
  | project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
)
| extend ThreatIndicator = "CVE-2026-54769-Langroid-RCE"
| order by TimeGenerated desc

index=* sourcetype IN ("access_combined", "access_combined_wcookie", "python", "uvicorn", "gunicorn", "linux_secure", "wineventlog")
| eval is_langroid_endpoint=if(match(uri_path, "(?i)(chat|agent|query|ask|tablechat)"), 1, 0)
| eval has_rce_payload=if(match(coalesce(uri_query, request_body, message, CommandLine, ""), "(__import__|__builtins__|os\.system|subprocess|__class__\.__mro__|__subclasses__|importlib|open\(.*\)|exec\(|eval\()"), 1, 0)
| eval has_child_proc=if(sourcetype IN ("wineventlog", "linux_secure") AND match(coalesce(ParentProcessName, ppid_name, ""), "(?i)(python|python3|uvicorn|gunicorn|fastapi)") AND match(coalesce(CommandLine, command, ""), "(?i)(curl|wget|bash|sh -c|nc |python -c|cmd\.exe|powershell)"), 1, 0)
| where has_rce_payload=1 OR has_child_proc=1
| eval threat_type=case(
    has_child_proc=1, "RCE_ChildProcess_Spawned",
    is_langroid_endpoint=1 AND has_rce_payload=1, "RCE_Payload_In_Request",
    has_rce_payload=1, "RCE_Payload_Detected"
  )
| eval cve="CVE-2026-54769"
| table _time, host, src_ip, uri_path, uri_query, threat_type, cve, user, ParentProcessName, CommandLine
| sort -_time

sequence by host.name with maxspan=5m
  [
    network where event.category == "network" and
    network.direction == "ingress" and
    (
      url.path : ("*chat*", "*agent*", "*query*", "*tablechat*") and
      (
        url.query : ("*__import__*", "*__builtins__*", "*os.system*", "*subprocess*", "*__subclasses__*", "*__mro__*") or
        http.request.body.content : ("*__import__*", "*__builtins__*", "*os.system*", "*subprocess*", "*__subclasses__*", "*__mro__*")
      )
    )
  ] by source.ip
  [
    process where event.type == "start" and
    process.parent.name : ("python", "python3", "uvicorn", "gunicorn") and
    (
      process.name : ("bash", "sh", "dash", "curl", "wget", "nc", "ncat", "python", "python3") or
      process.args : ("*-c*", "*exec*", "*import*", "*/bin/sh*")
    )
  ] by host.name
| head 100

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  "Event Name",
  "Username",
  "Process Name",
  "Command",
  CATEGORYNAME(category) AS category_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  (
    (
      LOWER(URL) MATCHES '.*(/chat|/agent|/query|/tablechat|/ask).*'
      AND (
        LOWER(URL) MATCHES '.*(__import__|__builtins__|os\.system|subprocess|__subclasses__|__mro__).*'
        OR LOWER("HTTP Request Body") MATCHES '.*(__import__|__builtins__|os\.system|subprocess|__subclasses__|__mro__).*'
      )
    )
    OR
    (
      LOWER("Process Name") MATCHES '.*(python|python3|uvicorn|gunicorn).*'
      AND (
        LOWER("Command") MATCHES '.*(curl|wget|bash|/bin/sh|nc |ncat|python -c|subprocess).*'
        OR LOWER("Child Process") MATCHES '.*(bash|sh|curl|wget|nc|ncat).*'
      )
    )
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Linux OS', 'Microsoft Windows Security Event Log', 'Python Application')
LAST 24 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=* ("langroid" OR "tablechat" OR "uvicorn" OR "gunicorn")
| parse regex "(?i)(?P<method>GET|POST|PUT|PATCH)\s+(?P<uri_path>/[^\s\?]*)(?:\?(?P<uri_query>[^\s]*))?" nodrop
| parse regex "(?i)parent[_\s]process[:\s=]+(?P<parent_proc>[^\s,\|]+)" nodrop
| parse regex "(?i)command[Line:\s=]+(?P<cmd_line>.{0,500})" nodrop
| where (
    (
      matches(uri_path, "(?i).*(chat|agent|query|tablechat|ask).*") and
      (
        matches(uri_query, "(?i).*(__import__|__builtins__|os\.system|subprocess|__subclasses__|__class__\.__mro__).*") or
        matches(_raw, "(?i).*(__import__|__builtins__|os\.system|subprocess|__subclasses__|__class__\.__mro__).*")
      )
    ) or
    (
      matches(parent_proc, "(?i).*(python|python3|uvicorn|gunicorn|fastapi).*") and
      matches(cmd_line, "(?i).*(curl|wget|bash|/bin/sh|nc |ncat|python -c|exec\().*")
    )
  )
| eval threat="CVE-2026-54769-Langroid-RCE"
| eval attack_phase=if(isNull(parent_proc), "Initial_Exploitation", "Post_Exploitation_RCE")
| count by _sourceHost, uri_path, uri_query, parent_proc, cmd_line, attack_phase, threat
| order by _count desc

rule CVE_2026_54769_Langroid_TableChatAgent_RCE {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects CVE-2026-54769 exploitation - Langroid TableChatAgent eval() sandbox escape leading to RCE"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/langroid/langroid/security/advisories/GHSA-q9p7-wqxg-mrhc"
    cve = "CVE-2026-54769"
    mitre_attack = "T1059.006, T1203, T1190"

  events:
    // Pattern 1: HTTP request with eval() sandbox escape payload
    (
      $http.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($http.network.http.target_url, `(?i)/(chat|agent|query|tablechat|ask)`)
        or re.regex($http.principal.url, `(?i)/(chat|agent|query|tablechat|ask)`)
      )
      and (
        re.regex($http.network.http.target_url, `(__import__|__builtins__|os\.system|subprocess|__subclasses__|__class__\.__mro__)`)
        or re.regex($http.network.http.request_body, `(__import__|__builtins__|os\.system|subprocess|__subclasses__|__class__\.__mro__)`)
      )
    )
    or
    // Pattern 2: Child process spawned from Python/Langroid process
    (
      $proc.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($proc.principal.process.file.full_path, `(?i)(python3?|uvicorn|gunicorn|fastapi)`)
      and (
        re.regex($proc.target.process.file.full_path, `(?i)/(bin/)?(bash|sh|dash|curl|wget|nc|ncat|python3?)$`)
        or re.regex($proc.target.process.command_line, `(?i)(-c\s|exec\(|import\s+os|subprocess|/bin/sh)`)
      )
    )

  condition:
    $http or $proc
}

// CVE-2026-54769: Langroid TableChatAgent eval() Sandbox Escape -> RCE
#event_simpleName IN ("ProcessRollup2", "NetworkReceiveAccept", "DnsRequest", "NetworkConnectIP4")
| case {
    #event_simpleName = "ProcessRollup2":
      CommandLine != null
      AND (
        ParentBaseFileName IN~ ("python.exe", "python3", "uvicorn", "gunicorn", "hypercorn", "daphne")
        OR ParentImageFileName MATCHES "(?i)(python|uvicorn|gunicorn)"
      )
      AND (
        CommandLine MATCHES "(?i)(__import__|os\.system|subprocess|exec\(|__builtins__|__subclasses__|__mro__)"
        OR FileName IN~ ("bash", "sh", "dash", "curl", "wget", "nc", "ncat", "cmd.exe", "powershell.exe")
      );
    #event_simpleName IN ("NetworkConnectIP4", "DnsRequest"):
      (
        RemotePort IN (4444, 1337, 8888, 9999, 31337, 4545)
        AND (
          ImageFileName MATCHES "(?i)(python|uvicorn|gunicorn)"
          OR ParentImageFileName MATCHES "(?i)(python|uvicorn|gunicorn)"
        )
      );
  }
| eval ThreatName = "CVE-2026-54769:Langroid:TableChatAgent:RCE"
| eval AttackPhase = case(
    #event_simpleName = "ProcessRollup2" AND ParentBaseFileName IN~ ("python.exe", "python3", "uvicorn", "gunicorn"), "PostExploit_ChildProc",
    #event_simpleName IN ("NetworkConnectIP4", "DnsRequest"), "PostExploit_C2_Callback",
    true(), "Unknown"
  )
| select timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4, RemotePort, ThreatName, AttackPhase
| sort timestamp desc
| limit 500