CVE-2026-54769 Overview
CVE-2026-54769 is a sandbox escape vulnerability in Langroid, a Python framework for building large-language-model-powered applications. Versions prior to 0.65.2 fail to properly restrict Python's eval() execution context in the TableChatAgent and VectorStore components. Attackers who control LLM prompt inputs can inject payloads that invoke Python built-ins such as __import__('os').system(), achieving unauthenticated Remote Code Execution (RCE) on the host running Langroid. The flaw is classified as Improper Control of Generation of Code [CWE-94]. Version 0.65.2 remediates the issue.
Critical Impact
Any attacker able to supply prompt content to a Langroid TableChatAgent or VectorStore with full_eval=True can execute arbitrary operating system commands without authentication.
Affected Products
- Langroid versions prior to 0.65.2
- Applications using TableChatAgent.pandas_eval() with full_eval=True
- Applications using VectorStore evaluation capabilities with full_eval=True
Discovery Timeline
- 2026-07-10 - CVE-2026-54769 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-54769
Vulnerability Analysis
Langroid attempts to sandbox LLM-generated expressions by passing an empty locals dictionary {} to Python's eval() function. This approach reflects an incomplete model of Python scoping. When __builtins__ is not explicitly scrubbed from the globals mapping, the Python interpreter implicitly injects the full built-in namespace at evaluation time. Attacker-supplied expressions therefore retain access to functions such as __import__, open, exec, and compile.
The TableChatAgent.pandas_eval() method evaluates external LLM output natively against a live Python interpreter. An attacker who influences the model's response, either directly through user input or indirectly through prompt injection in retrieved documents, can substitute a benign pandas expression for a command execution payload. Because Langroid runs the evaluation in-process, code executes with the privileges of the host application.
Root Cause
The root cause is an incorrect sandboxing pattern in the eval() invocation. Setting locals={} while leaving globals unrestricted does not remove __builtins__. Python guarantees built-in availability when __builtins__ is absent from globals, so the empty-locals technique provides no isolation. The correct pattern requires explicit globals={'__builtins__': {}} combined with strict expression parsing.
Attack Vector
Exploitation requires only that an attacker control text reaching an LLM whose output feeds into pandas_eval() or the equivalent VectorStore evaluation path. A payload such as __import__('os').system('...') embedded in a natural-language question or a poisoned retrieval-augmented document is sufficient. No authentication, prior access, or user interaction on the host is required. Refer to the GitHub Security Advisory GHSA-q9p7-wqxg-mrhc for the full technical writeup.
Detection Methods for CVE-2026-54769
Indicators of Compromise
- Child processes spawned by Python applications hosting Langroid, particularly shells (sh, bash, cmd.exe) or network utilities (curl, wget, nc).
- LLM prompt or response logs containing strings such as __import__, __builtins__, os.system, or subprocess originating from user or document sources.
- Outbound network connections from the Langroid host to unfamiliar IPs shortly after tool-message evaluation.
Detection Strategies
- Inspect application logs for calls to TableChatAgent.pandas_eval() where input contains Python dunder attributes or import statements.
- Correlate LLM interaction telemetry with process creation events on the same host to identify eval-triggered command execution.
- Deploy runtime monitoring on Python processes to flag eval() invocations that produce subprocess, os.system, or file-write operations.
Monitoring Recommendations
- Ingest process, network, and file telemetry from hosts running Langroid into a centralized data lake for cross-source correlation.
- Alert on any Langroid worker process that spawns interactive shells or writes to system directories.
- Track Langroid package versions across the environment and flag installations below 0.65.2.
How to Mitigate CVE-2026-54769
Immediate Actions Required
- Upgrade Langroid to version 0.65.2 or later across all environments running TableChatAgent or VectorStore components.
- Audit application code for any use of full_eval=True and disable it until the upgrade is complete.
- Rotate credentials, API keys, and secrets accessible to any Langroid host that processed untrusted prompts before patching.
Patch Information
Langroid version 0.65.2 patches CVE-2026-54769 by correcting the eval() sandboxing logic. See the GitHub Security Advisory GHSA-q9p7-wqxg-mrhc for release notes and the fix commit.
Workarounds
- Set full_eval=False on all TableChatAgent and VectorStore instances until the patched version is deployed.
- Run Langroid workloads inside a restricted OS-level sandbox such as a container with no network egress and a read-only filesystem.
- Filter LLM inputs and outputs to reject expressions containing __import__, __builtins__, exec, eval, compile, or open.
# Upgrade Langroid to the patched release
pip install --upgrade 'langroid>=0.65.2'
# Verify the installed version
python -c "import langroid; print(langroid.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
