{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/celery/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["celery","python","command-injection","execution","linux"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat brief addresses the detection of unauthorized shell execution originating from Celery worker processes, a common pattern observed in recent AI-agent prompt injection attacks. When Celery - a popular distributed task queue for Python - is utilized to power LLM-based agents, malicious input passed as tasks can trigger the evaluation of raw strings in a shell context. This vulnerability typically arises when developers utilize insecure methods like \u003ccode\u003eos.system\u003c/code\u003e or \u003ccode\u003eshell=True\u003c/code\u003e in subprocess calls while processing untrusted LLM outputs. This activity is critical to monitor as it represents a post-exploitation phase where an attacker upgrades a prompt injection vulnerability into arbitrary code execution on the worker infrastructure, enabling data exfiltration or internal network pivoting.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious prompt targeting an LLM-powered agent application.\u003c/li\u003e\n\u003cli\u003eThe LLM processes the input and returns a string containing shell metacharacters intended for system execution.\u003c/li\u003e\n\u003cli\u003eThe agent backend receives the untrusted output and passes it as an argument to a Celery task.\u003c/li\u003e\n\u003cli\u003eThe Celery worker process picks up the task from the message broker (e.g., Redis or RabbitMQ).\u003c/li\u003e\n\u003cli\u003eThe Python task function executes the untrusted string via \u003ccode\u003eos.system\u003c/code\u003e, \u003ccode\u003esubprocess.call\u003c/code\u003e with \u003ccode\u003eshell=True\u003c/code\u003e, or similar insecure APIs.\u003c/li\u003e\n\u003cli\u003eA child shell process (e.g., \u003ccode\u003e/bin/bash\u003c/code\u003e or \u003ccode\u003e/bin/sh\u003c/code\u003e) is spawned directly from the Python worker process.\u003c/li\u003e\n\u003cli\u003eThe attacker executes arbitrary commands within the spawned shell to maintain persistence or exfiltrate environment variables.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution on the worker infrastructure. Depending on the environment, this can lead to the exfiltration of sensitive LLM credentials, access to internal APIs, and further movement within the organization's cloud or container environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the provided Sigma rule to identify unauthorized shell spawning from Python-based Celery worker processes.\u003c/li\u003e\n\u003cli\u003eAudit codebases for the use of \u003ccode\u003eshell=True\u003c/code\u003e or \u003ccode\u003eos.system\u003c/code\u003e within task functions, ensuring that task arguments are properly sanitized or passed as command lists to avoid shell interpretation.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation and apply the principle of least privilege to the service accounts running the Celery workers.\u003c/li\u003e\n\u003cli\u003eEnable system-level process monitoring (e.g., Auditd or eBPF-based agents) to capture the full command-line arguments of spawned shells.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-17T15:43:33Z","date_published":"2026-10-17T15:43:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-celery-worker-shell/","summary":"Detection of system shell spawning from Celery worker processes indicates potential command or prompt injection exploitation within Python-based AI agent task frameworks.","title":"Shell Execution via Celery Worker Processes","url":"https://feed.craftedsignal.io/briefs/2026-10-celery-worker-shell/"}],"language":"en","title":"CraftedSignal Threat Feed - Celery","version":"https://jsonfeed.org/version/1.1"}