CVE-2025-46725High▾ TwilightLangroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.5%
LanceDocChatAgent uses pandas eval() through compute_from_docs():
https://github.com/langroid/langroid/blob/18667ec7e971efc242505196f6518eb19a0abc1c/langroid/vector_store/base.py#L136-L150
As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframe_calc compromising the host system.
Langroid 0.53.15 sanitizes input to the affected function by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.
langroid < 0.53.15Upgrade to a patched release:
langroid 0.53.15Connected by shared product, vendor, weakness, or advisory.
CVE-2025-46724Critical· 9.8Langroid has a Code Injection vulnerability in TableChatAgent
CVE-2026-25481CriticalLangroid has WAF Bypass Leading to RCE in TableChatAgent
CVE-2025-46726HighLangroid Allows XXE Injection via XMLToolMessage
CVE-2026-25879Critical· 9.8Langroid has Prompt to SQL Injection, Leading to RCE
CVE-2026-55615CriticalLangroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
CVE-2026-54760CriticalLangroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls