{"record":{"id":"cbe1de98dcc03709","repo":"huggingface/smolagents","slug":"forbidden-access-to-module-result-name-cbe1de","errorCode":null,"errorMessage":"Forbidden access to module: {result['__name__']}","messagePattern":"Forbidden access to module: (.+?)","errorType":"error_code","errorClass":"InterpreterError","httpStatus":null,"severity":"error","filePath":"src/smolagents/local_python_executor.py","lineNumber":173,"sourceCode":"\ndef check_safer_result(result: Any, static_tools: dict[str, Callable] = None, authorized_imports: list[str] = None):\n    \"\"\"\n    Checks if a result is safer according to authorized imports and static tools.\n\n    Args:\n        result (Any): The result to check.\n        static_tools (dict[str, Callable]): Dictionary of static tools.\n        authorized_imports (list[str]): List of authorized imports.\n\n    Raises:\n        InterpreterError: If the result is not safe\n    \"\"\"\n    if isinstance(result, ModuleType):\n        if not check_import_authorized(result.__name__, authorized_imports):\n            raise InterpreterError(f\"Forbidden access to module: {result.__name__}\")\n    elif isinstance(result, dict) and result.get(\"__spec__\"):\n        if not check_import_authorized(result[\"__name__\"], authorized_imports):\n            raise InterpreterError(f\"Forbidden access to module: {result['__name__']}\")\n    elif isinstance(result, (FunctionType, BuiltinFunctionType)):\n        for qualified_function_name in DANGEROUS_FUNCTIONS:\n            module_name, function_name = qualified_function_name.rsplit(\".\", 1)\n            if (\n                (static_tools is None or function_name not in static_tools)\n                and result.__name__ == function_name\n                and result.__module__ == module_name\n            ):\n                raise InterpreterError(f\"Forbidden access to function: {function_name}\")\n\n\ndef safer_eval(func: Callable):\n    \"\"\"\n    Decorator to enhance the security of an evaluation function by checking its return value.\n\n    Args:\n        func (Callable): Evaluation function to be made safer.\n","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/huggingface/smolagents/blob/30bb1161095dbae2271e6bc3cc4c219cc3897a57/src/smolagents/local_python_executor.py#L155-L191","documentation":"Same security check as the ModuleType case, but the returned object is a dict that looks like a module (it has a '__spec__' key, e.g. a module's __dict__ or a lazy/partial module object). If the module named in result['__name__'] is not in authorized_imports, the executor raises InterpreterError to prevent smuggling an unauthorized module out of the sandbox.","triggerScenarios":"Executed code returns a module's __dict__ (e.g. `vars(os)` or `os.__dict__`), or an object that carries a __spec__ entry, and the named module is not whitelisted in authorized_imports.","commonSituations":"LLM-generated code tries to exfiltrate a module by wrapping it in its __dict__; introspection code like `vars(module)` as the final expression; returning a namespace-like object built from a non-authorized module.","solutions":["Whitelist the module via additional_authorized_imports if it is genuinely needed","Return plain data (e.g. a specific attribute or a copy of needed keys) instead of the module __dict__","Audit the generated code: returning __spec__-bearing dicts is usually a sandbox-escape attempt and should be rejected in the prompt"],"exampleFix":"# before\ncode = \"import os\nos.__dict__\"\n\n# after\ncode = \"import os\nfinal_answer(os.getcwd())\"","handlingStrategy":"validation","validationCode":"def is_module_like(v) -> bool:\n    return isinstance(v, dict) and v.get('__spec__') is not None","typeGuard":"def is_module_like(v) -> bool:\n    return isinstance(v, dict) and v.get('__spec__') is not None","tryCatchPattern":"from smolagents.local_python_executor import InterpreterError\ntry:\n    evaluate_python(code, additional_authorized_imports=authorized)\nexcept InterpreterError as e:\n    if 'Forbidden access to module' in str(e):\n        log_sandbox_violation(code, e)","preventionTips":["Treat __spec__-bearing returns in generated code as a red flag and reject the snippet","Whitelist only the modules genuinely needed","Never pass module __dict__ objects across the sandbox boundary"],"tags":["smolagents","sandbox","module-dict","security","interpreter-error"],"backgroundTag":"module-import-not-authorized","analyzedSha":"30bb1161095dbae2271e6bc3cc4c219cc3897a57","analyzedAt":"2026-08-28T18:52:54.169Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}