Code Execution Vulnerability in Langroid Framework

CVE-2026-25481

What is CVE-2026-25481?

The Langroid framework, prior to version 0.59.32, contains a vulnerability that allows potential attackers to bypass security measures implemented in response to a previous vulnerability. The issue lies within the TableChatAgent, which can leverage the pandas_eval tool to evaluate expressions. Although a Web Application Firewall (WAF) was introduced to mitigate code injection risks, it can be circumvented if the _literal_ok() function fails to raise an UnsafeCommandError for invalid inputs. This flaw, combined with unrestricted access to dangerous dunder attributes, enables attackers to chain methods that are meant to be whitelisted, ultimately leading to the exposure of the eval builtin and the execution of arbitrary code. Users are encouraged to update to version 0.59.32 or later to address this security concern.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References