by Kastro
Paper/Archive/CVE-2026-25481

CVE-2026-25481

langroid langroid — Langroid has WAF Bypass Leading to RCE in TableChatAgent

EPSS 0.7%public exploitCVSS 9.6
critical.is priorityof 100
50
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 54.4.544 × 2010.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in langroid/utils/pandas_utils.py introduced to block code injection CVE-2025-46724. However it can be bypassed due to _literal_ok() returning False instead of raising UnsafeCommandError on invalid input, combined with unrestricted access to dangerous dunder attributes (__init__, __globals__, __builtins__). This allows chaining whitelisted DataFrame methods to leak the eval builtin and execute arbitrary code. This issue has been patched in version 0.59.32.

Affected

ProductAffectedFixed inSource
langroid< 0.59.32–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/langroid/langroid/security/advisories/GHSA-x34r-63hx-w57frefgithub.com/langroid/langroid/security/advisories/GHSA-jqq5-wc57-f8hjrefgithub.com/langroid/langroid/commit/30abbc1a854dee22fbd2f8b2f575dfdabdb603ea