9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25481

CVE-2026-25481: Langroid has WAF Bypass Leading to RCE in TableChatAgent

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in langroid/utils/pandas_utils.py introduced to block code injection CVE-2025-46724. However it can be bypassed due to _literal_ok() returning False instead of raising UnsafeCommandError on invalid input, combined with unrestricted access to dangerous dunder attributes (init, globals, builtins). This allows chaining whitelisted DataFrame methods to leak the eval builtin and execute arbitrary code. This issue has been patched in version 0.59.32.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25481

CVE-2026-25481:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langroid	pip	<= 0.59.31	0.59.32

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a bypass of a previous security fix (CVE-2025-46724) in the langroid library, resulting in a Remote Code Execution (RCE) vulnerability. The analysis of the provided security advisory, Proof-of-Concept, and the associated commit 30abbc1a854dee22fbd2f8b2f575dfdabdb603ea clearly identifies the pandas_eval method in the TableChatAgent class as the vulnerable function. The core of the vulnerability was an incomplete sanitization process for pandas expressions. The sanitizer, which uses an Abstract Syntax Tree (AST) visitor to inspect the expression, was missing logic to check for attribute access. This allowed an attacker to craft a payload that accessed dunder attributes (__...__) to traverse object internals and ultimately access the eval builtin for arbitrary code execution. The patch rectifies this by introducing a visit_Attribute method in the AST visitor to explicitly block access to these attributes. Therefore, TableChatAgent.pandas_eval is the function that would appear in a runtime profile when the vulnerability is exploited, as it is the function that directly processes the malicious input.

Vulnerable functions

TableChatAgent.pandas_eval

langroid/agent/special/table_chat_agent.py

The `pandas_eval` method within the `TableChatAgent` class processes user-supplied pandas expressions. It relies on a sanitization mechanism in `langroid/utils/pandas_utils.py` to prevent code execution. Prior to the fix, this sanitizer did not validate attribute access, allowing attackers to access dunder attributes like `__init__`, `__globals__`, and `__builtins__`. This oversight enabled a bypass of the security controls, allowing an attacker to gain access to Python's `eval` function and achieve remote code execution. The `pandas_eval` function is the entry point that receives the malicious expression and passes it to the flawed sanitizer.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.