https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:46:47 +0000 https://cve.radiocsirt.org/vuln/cve-2026-54769 <p><strong>Affected:</strong> langroid</p> <p>Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python&#39;s `eval()` function. However, this relies on an incomplete understanding of Python&#39;s execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__(&#39;os&#39;).system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. Version 0.65.2 patches the issue.</p> <p><strong>Affected:</strong> langroid</p> <p>Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python&#39;s `eval()` function. However, this relies on an incomplete understanding of Python&#39;s execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__(&#39;os&#39;).system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. Version 0.65.2 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-54769 https://cve.radiocsirt.org/vuln/ghsa-q9p7-wqxg-mrhc <p><strong>Affected:</strong> PyPI: langroid</p> <p>### Advisory Details **Title**: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent</p> <p>**Description**: ### Summary Langroid is vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python&#39;s `eval()` function. However, this relies on an incomplete understanding of Python&#39;s execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__(&#39;os&#39;).system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system.</p> <p>### Details The root cause lies in how the framework evaluates generated Python code without a proper restricted environment. Specifically, in `/langroid/agent/special/table_chat_agent.py` around line 239: ```python # The `vars` mapping does not proactively overwrite or remove `__builtins__` # The empty `{}` locals parameter provides false security. eval_result = eval(code, vars, {}) ``` And similarly in `/langroid/vector_store/base.py` around line 225: ```python result = eval(code, vars, {}) ``` A…</p> <p><strong>Affected:</strong> PyPI: langroid</p> <p>### Advisory Details **Title**: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent</p> <p>**Description**: ### Summary Langroid is vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python&#39;s `eval()` function. However, this relies on an incomplete understanding of Python&#39;s execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__(&#39;os&#39;).system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system.</p> <p>### Details The root cause lies in how the framework evaluates generated Python code without a proper restricted environment. Specifically, in `/langroid/agent/special/table_chat_agent.py` around line 239: ```python # The `vars` mapping does not proactively overwrite or remove `__builtins__` # The empty `{}` locals parameter provides false security. eval_result = eval(code, vars, {}) ``` And similarly in `/langroid/vector_store/base.py` around line 225: ```python result = eval(code, vars, {}) ``` A…</p> https://cve.radiocsirt.org/vuln/ghsa-q9p7-wqxg-mrhc