111 matches found
The vulnerability in the XMLToolMessage class of the langroid Python framework for application development allows a attacker to trigger a service failure or disclose protected information.
The vulnerability of the XMLToolMessage class in the langroid application development framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures or expose sensitive information...
EUVD-2025-15952
Malicious code in bioql PyPI...
EUVD-2025-13410
Malicious code in bioql PyPI...
EUVD-2025-15951
Malicious code in bioql PyPI...
Arbitrary Code Execution
Langroid is vulnerable to Arbitrary Code Execution. The vulnerability is due to unsafe code evaluation due to the use of pandas.eval in the LanceDocChatAgent via the computefromdocs function, allowing attackers to execute malicious code through unsanitized input...
CVE-2025-46725
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, LanceDocChatAgent uses pandas eval through computefromdocs. As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc compromising t...
CVE-2025-46724
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, TableChatAgent uses pandas eval. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes...
CVE-2025-46724
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, TableChatAgent uses pandas eval. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes...
CVE-2025-46725
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, LanceDocChatAgent uses pandas eval through computefromdocs. As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc compromising t...
Arbitrary Code Injection
Overview langroid is a Harness LLMs with Multi-Agent Programming Affected versions of this package are vulnerable to Arbitrary Code Injection through the computefromdocs process. An attacker can execute arbitrary code by manipulating the input data to the QueryPlan.dataframecalc method. Remediati...
Arbitrary Code Injection
Overview langroid is a Harness LLMs with Multi-Agent Programming Affected versions of this package are vulnerable to Arbitrary Code Injection due to the use of pandas eval function. An attacker can execute arbitrary code by supplying malicious input to this function. This is only exploitable if t...
CVE-2025-46725 Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, LanceDocChatAgent uses pandas eval through computefromdocs. As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc compromising t...
CVE-2025-46725 Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, LanceDocChatAgent uses pandas eval through computefromdocs. As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc compromising t...
CVE-2025-46725 Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, LanceDocChatAgent uses pandas eval through computefromdocs. As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc compromising t...
CVE-2025-46725
Langroid (Python framework for LLM-powered apps) contains a code execution vulnerability in the LanceDocChatAgent prior to version 0.53.15, caused by the use of pandas.eval() in the compute_from_docs() path. An attacker could cause the agent to execute malicious commands via crafted input and rel...
CVE-2025-46724 Langroid has a Code Injection vulnerability in TableChatAgent
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, TableChatAgent uses pandas eval. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes...
CVE-2025-46724 Langroid has a Code Injection vulnerability in TableChatAgent
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, TableChatAgent uses pandas eval. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes...
CVE-2025-46724
Langroid CVE-2025-46724 affects TableChatAgent, where untrusted input can trigger code injection via pandas_eval in TableChatAgent prior to v0.53.15. The project added a WAF in pandas_utils.py and warnings, with a patch in v0.59.32 that blocks the bypass. However, subsequent disclosures (CVE-2026...
CVE-2025-46724 Langroid has a Code Injection vulnerability in TableChatAgent
Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, TableChatAgent uses pandas eval. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes...
PT-2025-22276
Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.53.15 Description The issue concerns Langroid, a Python framework for building large language model LLM-powered applications. In versions prior to 0.53.15, the TableChatAgent uses pandas eval, which may be vulnerab...