Eval Injection Vulnerability in Google Langfun Product
CVE-2026-75062

9.2CRITICAL

Key Information:

Vendor

Google
Status
Langfun
Vendor
CVE Published:
26 August 2026

What is CVE-2026-75062?

An Eval Injection vulnerability exists in the default lf.query Python protocol of Google Langfun versions before 0.1.2. This flaw permits remote unauthenticated attackers to execute arbitrary Python code. By crafting specific prompt inputs, an attacker can manipulate the model into generating and evaluating executable Python expressions without the implementation of a secure sandbox, leading to potential unauthorized access and control over the host application.

Affected Version(s)

langfun 0.0.1 < 0.1.2

References

https://github.com/google/langfun
product
https://github.com/google/langfun/issues/725
issue-tracking

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.