Fix: Enforce sandbox evaluation in PythonFunction.implementation

[Rickidevs]

Security Fix: Unsandboxed Code Execution in PythonFunction

Summary

PythonFunction.implementation was calling execution.run(self.source)
without explicit sandbox parameter, allowing arbitrary code execution
in the main process.

Fix

Added explicit sandbox=True parameter to execution.run() call.

Security Impact

Without this fix, any untrusted input processed by PythonFunction
(LLM output, MCP server responses) could execute arbitrary OS commands
in the host process — including file access, network calls, and
environment variable theft.

Note

A detailed vulnerability report including PoC has been submitted to
Google OSS VRP. PoC details are withheld pending merge to avoid
premature disclosure.

Related: [Google OSS VRP submission - pending]

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.