Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-46724
Good to know:
Date: May 20, 2025
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, "TableChatAgent" uses "pandas eval()". If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to "TableChatAgent" by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.
Severity Score
Related Resources (5)
Severity Score
Weakness Type (CWE)
Improper Control of Generation of Code ('Code Injection')
CWE-94Top Fix
Upgrade Version
Upgrade to version langroid - 0.53.15;https://github.com/langroid/langroid.git - 0.53.15
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |