8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46725

CVE-2025-46725: Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

Summary

LanceDocChatAgent uses pandas eval() through compute_from_docs(): https://github.com/langroid/langroid/blob/18667ec7e971efc242505196f6518eb19a0abc1c/langroid/vector_store/base.py#L136-L150

As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframe_calc compromising the host system.

Fix

Langroid 0.53.15 sanitizes input to the affected function by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-46725

CVE-2025-46725:

8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langroid	pip	< 0.53.15	0.53.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the provided commit 0d9e4a7bb3ae2eef8d38f2e970ff916599a2b2a6, which addresses the code injection vulnerability. The commit diff explicitly shows modifications to two functions where eval() is used:

langroid.vector_store.base.VectorStore.compute_from_docs: The patch modifies this function to add a call to sanitize_command for the calc input before it is passed to eval(). This directly corresponds to the vulnerability described in the advisory GHSA-22c2-9gwg-mj59, which mentions LanceDocChatAgent using pandas eval() through vector_store.compute_from_docs().
langroid.agent.special.table_chat_agent.TableChatAgent.pandas_eval: This function is also modified in the patch to add a call to sanitize_command for the exprn input before it is passed to eval(), contingent on a new full_eval configuration flag.

In both cases, the 'before' state (implied by the patch that adds sanitization) involved passing potentially user-controlled input directly to eval(), which is a classic code injection vulnerability. The functions are identified by their full namespace, class, and method name as they would appear in runtime profiles. The evidence is taken directly from the changes in the commit patch, specifically the lines where eval() was used on unsanitized input (removed lines) and the introduction of sanitization (added lines).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.