CVE-2026-54769 Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
Attackers can achieve remote code execution by exploiting incomplete sandboxing in eval() when processing LLM outputs in Langroid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54769?
CVE-2026-54769 is a critical code injection vulnerability in langroid, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python's `eval()` function. However, this relies on an incomplete understanding of Python's execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__('os').system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. Version 0.65.2 patches the issue.
Weakness: CWE-94
Which versions are affected by CVE-2026-54769?
3 open source packages ship an affected version, including langroid.
| Package | Affected | Fixed in |
|---|---|---|
langroid PyPI | All versions | 0.65.2 |
langroid PyPI | All versions | 0.65.2 |
langroid PyPI | All versions | 0.65.2 |
How do I fix CVE-2026-54769?
Upgrade langroid to 0.65.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-54769 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54769 exists.
Sources
Also known as GHSA-q9p7-wqxg-mrhc, PYSEC-2026-2581.