CVE-2025-46724: Langroid

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to `TableChatAgent` by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.

Affected products

• Langroid Langroid: before 0.53.15 (fixed in 0.53.15)

Published 2025-05-20. Last modified 2026-06-17.