CVE-2025-46724

Katalog CVE

CVSS 9.8 · Critical EPSS 0,83%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada langroid. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to `TableChatAgent` by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.

Rincian

Terbit di NVD

20 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langroid/langroid/security/advisories/GHSA-jqq5-wc57-f8hj exploit · advisory vendor
• https://github.com/langroid/langroid/commit/0d9e4a7bb3ae2eef8d38f2e970ff916599a2b2a6 patch