Read the docs
TI-2026-20592 Aliases CVE-2026-25481GHSA-x34r-63hx-w57f

Langroid has WAF Bypass Leading to RCE in TableChatAgent

Priority HIGH 82CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in langroid/utils/pandas_utils.py introduced to block code injection CVE-2025-46724. However it can be bypassed due to _literal_ok() returning False instead of raising UnsafeCommandError on invalid input, combined with unrestricted access to dangerous dunder attributes (__init__, __globals__, __builtins__). This allows chaining whitelisted DataFrame methods to leak the eval builtin and execute arbitrary code. This issue has been patched in version 0.59.32.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00733 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed langroid (langroid): 0.59.32langroid (PyPI): 0.59.32

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
langroidlangroidbefore 0.59.320.59.32Patch availableCNA
—langroid (PyPI)before 0.59.320.59.32Patch availableGHSA-x34r-63hx-w57f
  • langroid Vendorlangroid Affected before 0.59.32 Fixed in 0.59.32 Patch available CNA
  • langroid (PyPI) Vendor— Affected before 0.59.32 Fixed in 0.59.32 Patch available GHSA-x34r-63hx-w57f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:langroid:langroid:*:*:*:*:*:*:*:*before 0.59.32Vulnerablelangroid
  • cpe:2.3:a:langroid:langroid:*:*:*:*:*:*:*:* Versions before 0.59.32 Vulnerable ·langroid

Remediation

  • Fix · CNA langroid (langroid) Fixed in 0.59.32
  • Fix · GHSA-x34r-63hx-w57f langroid (PyPI) Fixed in 0.59.32 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25481
  2. 2026-10-03 Alias added: GHSA-x34r-63hx-w57f

References

Exploit 1

Patch 1

Advisory 2

Other 3

  • TI-2025-29395 Langroid has a Code Injection vulnerability in TableChatAgent CVSS 3.1CRITICAL 9.8
  • TI-2025-29397 Langroid Vulnerable to XXE Injection via XMLToolMessage CVSS 4.0HIGH 7.8
  • TI-2025-29396 Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store CVSS 4.0HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences