10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54769

CVE-2026-54769: Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its TableChatAgent and VectorStore capabilities. When these agents evaluate LLM-generated tool messages with full_eval=True, they attempt to sandbox the execution by explicitly setting locals to an empty dictionary {} inside Python's eval() function. However, this relies on an incomplete understanding of Python's execution model. Because __builtins__ is not explicitly scrubbed from the globals dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like __import__('os').system(). Since TableChatAgent.pandas_eval() executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. Version 0.65.2 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54769

CVE-2026-54769:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langroid	pip	<= 0.65.1	0.65.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in two locations within the langroid library where the eval() function is used to execute code derived from user input. The advisory points out that TableChatAgent.pandas_eval and a function in VectorStore (which the patch reveals to be VectorStore.compute_from_docs) are affected. The core of the vulnerability is that eval() was called with an empty locals dictionary ({}), which was intended to act as a sandbox. However, the globals dictionary passed to eval() was not sanitized. When Python's eval() does not find a __builtins__ key in the globals dictionary, it automatically injects the full builtins module, which includes dangerous functions like __import__, open, and exec. An attacker could craft input that causes the Large Language Model (LLM) to generate Python code containing a payload like __import__('os').system('command'). This payload would then be executed by eval(), resulting in Remote Code Execution (RCE) on the host system. The patch addresses this by introducing a new function, safe_eval_globals, which creates a globals dictionary with a heavily restricted __builtins__ set, removing access to these dangerous functions.

Vulnerable functions

TableChatAgent.pandas_eval

langroid/agent/special/table_chat_agent.py

The function `pandas_eval` in `TableChatAgent` uses `eval` on user-provided code. The `globals` argument to `eval` was not properly sanitized, allowing access to Python's `__builtins__` module. This enables an attacker to execute arbitrary system commands via functions like `__import__('os').system()`.

VectorStore.compute_from_docs

langroid/vector_store/base.py

The function `compute_from_docs` in `VectorStore` uses `eval` on user-provided code. The `globals` argument to `eval` was not properly sanitized, allowing access to Python's `__builtins__` module. This enables an attacker to execute arbitrary system commands via functions like `__import__('os').system()`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.