wololo! - #3056
2 issues
security-review: Found 2 issues (1 high, 1 medium)
High
Untrusted LLM patch output is evaluated as Ruby, enabling RCE - `sentry-ruby/lib/sentry-ruby.rb:286`
When Wololo is enabled, the remote LLM response is treated as Ruby source and evaluated in TOPLEVEL_BINDING without enforcing that it contains only method definitions. A response containing one valid method plus a top-level operation such as system, file access, or network access can therefore execute arbitrary code in the application process; request-controlled exception data is included in the LLM prompt and can enable prompt injection.
Also found at:
sentry-ruby/lib/sentry/hub.rb:174sentry-ruby/lib/sentry/wololo.rb:91-99sentry-ruby/lib/sentry/wololo.rb:386-388sentry-ruby/lib/sentry/wololo.rb:426-501
Medium
Opt-in Wololo sends unredacted application source and exception data to OpenRouter - `sentry-ruby/lib/sentry-ruby.rb:286`
When an application enables config.wololo and supplies an OpenRouter key, captured exceptions with in-app frames cause Wololo to send exception messages, backtraces, and up to 200 KB of local application source to OpenRouter. Source files and exception data may contain credentials or PII, and the request has no redaction or configurable filtering before crossing the application’s data boundary.
⏱ 8m 23s · 1.6M in / 93.7k out · $1.00
Annotations
Check failure on line 286 in sentry-ruby/lib/sentry-ruby.rb
sentry-warden / warden: security-review
Untrusted LLM patch output is evaluated as Ruby, enabling RCE
When Wololo is enabled, the remote LLM response is treated as Ruby source and evaluated in TOPLEVEL_BINDING without enforcing that it contains only method definitions. A response containing one valid method plus a top-level operation such as system, file access, or network access can therefore execute arbitrary code in the application process; request-controlled exception data is included in the LLM prompt and can enable prompt injection.
Check failure on line 174 in sentry-ruby/lib/sentry/hub.rb
sentry-warden / warden: security-review
[NWG-8RS] Untrusted LLM patch output is evaluated as Ruby, enabling RCE (additional location)
When Wololo is enabled, the remote LLM response is treated as Ruby source and evaluated in TOPLEVEL_BINDING without enforcing that it contains only method definitions. A response containing one valid method plus a top-level operation such as system, file access, or network access can therefore execute arbitrary code in the application process; request-controlled exception data is included in the LLM prompt and can enable prompt injection.
Check failure on line 99 in sentry-ruby/lib/sentry/wololo.rb
sentry-warden / warden: security-review
[NWG-8RS] Untrusted LLM patch output is evaluated as Ruby, enabling RCE (additional location)
When Wololo is enabled, the remote LLM response is treated as Ruby source and evaluated in TOPLEVEL_BINDING without enforcing that it contains only method definitions. A response containing one valid method plus a top-level operation such as system, file access, or network access can therefore execute arbitrary code in the application process; request-controlled exception data is included in the LLM prompt and can enable prompt injection.
Check failure on line 388 in sentry-ruby/lib/sentry/wololo.rb
sentry-warden / warden: security-review
[NWG-8RS] Untrusted LLM patch output is evaluated as Ruby, enabling RCE (additional location)
When Wololo is enabled, the remote LLM response is treated as Ruby source and evaluated in TOPLEVEL_BINDING without enforcing that it contains only method definitions. A response containing one valid method plus a top-level operation such as system, file access, or network access can therefore execute arbitrary code in the application process; request-controlled exception data is included in the LLM prompt and can enable prompt injection.
Check failure on line 501 in sentry-ruby/lib/sentry/wololo.rb
sentry-warden / warden: security-review
[NWG-8RS] Untrusted LLM patch output is evaluated as Ruby, enabling RCE (additional location)
When Wololo is enabled, the remote LLM response is treated as Ruby source and evaluated in TOPLEVEL_BINDING without enforcing that it contains only method definitions. A response containing one valid method plus a top-level operation such as system, file access, or network access can therefore execute arbitrary code in the application process; request-controlled exception data is included in the LLM prompt and can enable prompt injection.
Check warning on line 286 in sentry-ruby/lib/sentry-ruby.rb
sentry-warden / warden: security-review
Opt-in Wololo sends unredacted application source and exception data to OpenRouter
When an application enables `config.wololo` and supplies an OpenRouter key, captured exceptions with in-app frames cause Wololo to send exception messages, backtraces, and up to 200 KB of local application source to OpenRouter. Source files and exception data may contain credentials or PII, and the request has no redaction or configurable filtering before crossing the application’s data boundary.