AIKIDO-2026-715792

TL;DR

The install_packages() method of the Code Interpreter client builds a pip install shell command from caller-supplied package specifiers. Its allowlist regex permits arbitrary characters inside the extras brackets and the package arguments are not shell-quoted, so a specifier such as requests[$(id)] passes validation and is interpreted by the shell. A remote authenticated user who can influence the package strings passed to the method can execute arbitrary commands within the Code Interpreter sandbox. The fix restricts the extras group to valid extra-name characters and quotes each package argument with shlex.quote before constructing the command.