CVE-2025-4032: Inclusionai Aworld RCE Vulnerability

CVE-2025-4032 Overview

CVE-2025-4032 is an OS command injection vulnerability in inclusionAI AWorld affecting commits up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. The flaw resides in the subprocess.run/subprocess.Popen calls within AWorld/aworld/virtual_environments/terminals/shell_tool.py. Attackers can manipulate input passed to these calls to execute arbitrary operating system commands remotely. The vendor does not use versioning, so affected and unaffected releases cannot be enumerated. The exploit has been publicly disclosed through GitHub issue tracking and VulDB, though successful exploitation requires high attack complexity and authenticated access with low privileges.

Critical Impact
Successful exploitation grants remote command execution on the host running the AWorld shell tool, enabling adversaries to read, modify, or pivot from the underlying environment.

Affected Products

inclusionAI AWorld (all versions through commit 8c257626e648d98d793dd9a1a950c2af4dd84c4e)
AWorld/aworld/virtual_environments/terminals/shell_tool.py component
Deployments invoking subprocess.run or subprocess.Popen from the shell tool

Discovery Timeline

2025-04-28 - CVE-2025-4032 published to NVD
2025-05-10 - Last updated in NVD database

Technical Details for CVE-2025-4032

Vulnerability Analysis

The vulnerability is classified as OS command injection under [CWE-77] (Command Injection) and [CWE-78] (OS Command Injection). AWorld is an AI agent framework that exposes a shell tool allowing agents to invoke commands inside virtual terminal environments. The affected file shell_tool.py passes attacker-influenced input to Python's subprocess.run and subprocess.Popen functions in a manner that does not sufficiently sanitize shell metacharacters. When command strings are constructed by concatenating untrusted input, an attacker can append shell operators such as ;, &&, |, or backticks to break out of the intended command and execute arbitrary instructions. Public disclosure references include the GitHub Issue Discussion and the VulDB entry #306395.

Root Cause

The root cause is unsafe construction of subprocess invocations within the shell tool. Passing concatenated strings to subprocess APIs with shell=True, or assembling argument lists from unsanitized user-controlled data, allows shell interpretation of injected operators. The AWorld project does not employ release versioning, which complicates downstream tracking of the fix.

Attack Vector

Exploitation requires network reach to the AWorld interface and low-privileged authentication. An attacker submits crafted input that is forwarded to the shell tool, where the unsanitized string reaches subprocess.run or subprocess.Popen. Because the attack complexity is high, the adversary must understand the input flow and craft a payload that survives any partial filtering. Successful injection runs commands under the privileges of the AWorld process.

The vulnerability mechanism is straightforward: user-controlled values are interpolated into a command string that is then executed through a shell context. See the GitHub Issue Detail for the reporter's technical analysis.

Detection Methods for CVE-2025-4032

Indicators of Compromise

Unexpected child processes spawned by the AWorld Python runtime, especially shells (sh, bash, cmd.exe) executing commands unrelated to legitimate agent tasks.
Outbound network connections originating from the AWorld host to unfamiliar destinations following shell tool invocations.
Log entries in AWorld showing shell tool inputs containing metacharacters such as ;, &&, |, $(), or backticks.

Detection Strategies

Audit calls to subprocess.run and subprocess.Popen in shell_tool.py for use of shell=True or string concatenation with external input.
Deploy runtime process monitoring to flag the AWorld parent process spawning shell interpreters with non-allowlisted commands.
Correlate AWorld application logs with host-level process telemetry to identify command strings containing shell injection patterns.

Monitoring Recommendations

Forward AWorld application logs and host process events into a centralized analytics pipeline for query-based hunting.
Alert on any process tree where the AWorld service is the parent of an interactive shell that subsequently launches network utilities such as curl, wget, or nc.
Track file integrity on shell_tool.py to detect tampering or unauthorized modifications to the command execution logic.

How to Mitigate CVE-2025-4032

Immediate Actions Required

Restrict network exposure of AWorld deployments and require authenticated, trusted users only for any shell tool functionality.
Disable or remove the shell tool from agent configurations until the code path is patched, particularly in multi-tenant environments.
Run AWorld under a least-privileged service account inside an isolated container or sandbox to limit blast radius.

Patch Information

No official versioned patch is referenced in the advisory because the project does not use release versioning. Operators should pull the latest commit from the upstream inclusionAI/AWorld repository and verify that shell_tool.py no longer passes unsanitized input to subprocess APIs. Track the GitHub Issue Comment thread for upstream remediation status.

Workarounds

Modify local forks of shell_tool.py to invoke subprocess.run with shell=False and pass arguments as a list rather than a concatenated string.
Implement an allowlist of permitted commands and reject any input containing shell metacharacters before dispatching to the subprocess call.
Wrap the AWorld runtime in a container with read-only filesystem mounts, dropped capabilities, and egress filtering to contain successful injections.

bash

# Configuration example: run AWorld in a hardened container
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  --user 10001:10001 \
  --network aworld-restricted \
  -v /opt/aworld/data:/data:ro \
  aworld:latest