@erzhe-lume/dsh-tool-mathfig

expr() is called on caller-supplied strings (region, integrand, up, down, F, G) that arrive unvalidated through figure_template's params object (additionalProperties: true). Because the globals dict has no __builtins__, Python injects the real builtins, so an expression such as __import__('os').system('...') or open(...).read() executes with the DSH host process's privileges — arbitrary command execution, file read/write and network access, reachable by any prompt-injected or malicious tool call. The adjacent comment arguing that restricting builtins has 'no real security benefit' is a design

figure_formula's savePath and figure_template's outDir are passed straight through to mkdirSync({recursive:true}) and to matplotlib savefig, with no confinement to cfg.outputDir. A prompt-injected tool call can create arbitrary directory trees and overwrite existing .png files anywhere the host user can write. Content is limited to PNG bytes, so the impact is nuisance/overwrite rather than code execution.