Critical Security Fix: Prevent Remote Code Execution (RCE) in invite_users_to_challenge() (Replace eval() with json.loads())

[vishalharkal15]

A critical Remote Code Execution (RCE) vulnerability was identified in apps/challenges/views.py inside the invite_users_to_challenge() function (around line ~3090). The issue was caused by unsafe usage of Python’s eval() on user-controlled input (request.data.get("emails")), which allowed attackers to execute arbitrary code on the server. To fix this, the dangerous eval() call was replaced with json.loads() and additional type validation was added to ensure the input is always a list of email addresses. Exception handling was also improved, including handling for ChallengeHost.MultipleObjectsReturned, preventing potential crashes or DoS scenarios from database integrity issues. This patch fully eliminates the RCE attack vector, improves reliability, and ensures malicious payloads like __import__('os').system('whoami') now fail safely with a proper 400 Bad Request response.

[SarvasvaChaubey]

“I’d like to take this up. Planning to replace the unsafe eval() usage with safe parsing and add input validation. Please assign this to me.”