CVE-2025-46725 Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

Langroid is a Python framework to build large language model LLM-powered applications. Prior to version 0.53.15, LanceDocChatAgent uses pandas eval through computefromdocs. As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc compromising t...

CVE-2025-46725

Langroid (Python framework for LLM-powered apps) contains a code execution vulnerability in the LanceDocChatAgent prior to version 0.53.15, caused by the use of pandas.eval() in the compute_from_docs() path. An attacker could cause the agent to execute malicious commands via crafted input and rel...