Sign in
Deutsch English Español Polski
High

Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

  • Disclosed: 20.05.2025
  • Updated: 11.10.2026 13:18

Summary

LanceDocChatAgent uses pandas eval() through compute_from_docs(): https://github.com/langroid/langroid/blob/18667ec7e971efc242505196f6518eb19a0abc1c/langroid/vector_store/base.py#L136-L150

As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframe_calc compromising the host system.

Fix

Langroid 0.53.15 sanitizes input to the affected function by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) langroid < 0.53.15 0.53.15

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weakness (CWE)
CWE-94
Platform
Python (PyPI)
Package
langroid
Disclosed
20.05.2025
Updated
11.10.2026 13:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-1531 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-22c2-9gwg-mj59 - CC BY 4.0

Vulnerability history: langroid

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (11) in the archive
Total entries
11
First → latest
05.2025 07.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 6
  • High 5

Disclosures per year

Severity:
  1. Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
    Critical CVE-2026-55615 < 0.65.5 0.65.5
  2. Langroid: handle_message() executes user-supplied tool JSON without sender verification
    High · 8.1 CVE-2026-54771 < 0.65.3 0.65.3
  3. Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
    Critical · 10.0 CVE-2026-54769 < 0.65.2 0.65.2
  4. Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
    Critical CVE-2026-54760 < 0.65.1 0.65.1
  5. Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
    High CVE-2026-50180 < 0.64.0 0.64.0
  6. Langroid: Path traversal in the file tools allows read/write outside configured current directory
    High · 7.1 CVE-2026-50181 < 0.64.0 0.64.0
  7. Langroid has Prompt to SQL Injection, Leading to RCE
    Critical · 9.8 CVE-2026-25879 < 0.63.0 0.63.0
  8. Langroid has WAF Bypass Leading to RCE in TableChatAgent
    Critical CVE-2026-25481 < 0.59.32 0.59.32
  9. Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store this entry
    High CVE-2025-46725 < 0.53.15 0.53.15
  10. Langroid has a Code Injection vulnerability in TableChatAgent
    Critical · 9.8 CVE-2025-46724 < 0.53.15 0.53.15
  11. Langroid Allows XXE Injection via XMLToolMessage
    High CVE-2025-46726 < 0.53.4 0.53.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.