CVE-2025-46724

CRITICAL

9.8

Description

Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to `TableChatAgent` by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie5/20/2025

Derniere modification6/17/2025

Sourcenvd

Observations honeypot0

Produits affectes

langroid:langroid

Faiblesses (CWE)

CWE-94

References

https://github.com/langroid/langroid/commit/0d9e4a7bb3ae2eef8d38f2e970ff916599a2b2a6(security-advisories@github.com)

https://github.com/langroid/langroid/security/advisories/GHSA-jqq5-wc57-f8hj(security-advisories@github.com)

https://github.com/langroid/langroid/security/advisories/GHSA-jqq5-wc57-f8hj(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.