AIKIDO-2025-10505

TL;DR

Affected versions of this package contain an arbitrary code execution vulnerability in the _object_to_tool_call function due to unsafe use of eval(). The function attempts to convert string items in a list to dictionaries via eval(item) without sanitization, allowing attackers to craft malicious strings that execute arbitrary Python code when processed. For example, an attacker could submit a payload like __import__('os').system('rm -rf /') as a item, enabling remote command execution, data deletion, or system compromise if the input originates from untrusted sources.