CVE-2025-46724
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to `TableChatAgent` by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.
- Affected products
- Langroid
- Langroid
- < 0.53.15
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.8% (55th percentile)
- Weakness
- CWE-94
- NVD status
- Analyzed
- Published
- 2025-05-20
CVE-2025-46724 at NVD
No indexed exploits for CVE-2025-46724 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-46724 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.