CVE-2025-46724

CRITICAL

9.8

Description

Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to `TableChatAgent` by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published5/20/2025

Last Modified6/17/2025

Sourcenvd

Honeypot Sightings0

Affected Products

langroid:langroid

Weaknesses (CWE)

CWE-94

References

https://github.com/langroid/langroid/commit/0d9e4a7bb3ae2eef8d38f2e970ff916599a2b2a6(security-advisories@github.com)

https://github.com/langroid/langroid/security/advisories/GHSA-jqq5-wc57-f8hj(security-advisories@github.com)

https://github.com/langroid/langroid/security/advisories/GHSA-jqq5-wc57-f8hj(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.