CVE-2026-75062 Overview
CVE-2026-75062 is an eval injection vulnerability [CWE-95] in Google's langfun library, an open-source framework for language model programming. The flaw resides in the default lf.query Python protocol in versions prior to 0.1.2. Attackers can supply crafted prompt inputs that steer the underlying language model into emitting executable Python expressions. The langfun runtime then evaluates those expressions without a sandbox, granting arbitrary code execution in the host application's context. Remote, unauthenticated attackers can trigger the vulnerability over the network wherever langfun accepts external prompt data.
Critical Impact
Unauthenticated remote attackers can execute arbitrary Python code in the host application by injecting prompts that cause the model to emit expressions evaluated outside any sandbox.
Affected Products
- Google langfun versions prior to 0.1.2
- Applications embedding the default lf.query Python protocol
- LLM-backed services that forward untrusted user input to langfun
Discovery Timeline
- 2026-08-26 - CVE-2026-75062 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75062
Vulnerability Analysis
The langfun framework exposes lf.query as a high-level primitive that asks a language model to return structured Python values. The default Python protocol parses the model's response and evaluates it as Python code to reconstruct the requested object. When user-controlled text reaches the prompt, an attacker can steer the model into producing Python expressions with side effects rather than benign literals. Because evaluation happens in the host process without isolation, any emitted code runs with the privileges of the calling application. This turns an ordinary LLM integration into a remote code execution surface reachable through prompt inputs.
Root Cause
The root cause is trust in language model output. The lf.query Python protocol treats the model's response as safe Python source and evaluates it directly. There is no sandbox, no AST allow-list, and no restriction on callables or attribute access. Model output is inherently untrusted when any part of the prompt originates from an attacker, so this design allows prompt injection to escalate into eval injection [CWE-95].
Attack Vector
An attacker submits crafted content through any interface that feeds text into lf.query, such as a chat endpoint, document upload, retrieval-augmented generation source, or tool response. The malicious input instructs the model to return a Python expression that imports modules, spawns processes, or exfiltrates data. The langfun protocol evaluates the response, executing the attacker's payload. No authentication, credentials, or user interaction beyond supplying the input is required. See the GitHub issue #725 discussion for maintainer analysis and the langfun repository for the fixed code.
No verified public exploit code is available. Refer to the vendor references above for technical details on the vulnerable code path.
Detection Methods for CVE-2026-75062
Indicators of Compromise
- Unexpected child processes spawned by Python interpreters hosting langfun workloads, such as sh, bash, curl, or python -c.
- Outbound network connections from LLM application hosts to unfamiliar domains shortly after user prompts are processed.
- Log entries showing lf.query responses that contain Python keywords such as import, __import__, eval, exec, open, or subprocess.
- New files written by the LLM service account under paths not used by normal application logic.
Detection Strategies
- Instrument the langfun protocol layer to log raw model output before evaluation and alert on syntactic patterns associated with code execution.
- Correlate prompt content, model response, and subsequent process or socket activity to identify prompt-driven code execution chains.
- Deploy runtime process monitoring on hosts running langfun to flag any deviation from the expected Python-only process tree.
Monitoring Recommendations
- Baseline the expected outbound destinations and child processes of each LLM service, then alert on deviations.
- Track installed langfun versions across build artifacts and running containers using software bill of materials data.
- Forward application, process, and network telemetry from LLM hosts to a central data lake for cross-signal analysis.
How to Mitigate CVE-2026-75062
Immediate Actions Required
- Upgrade langfun to version 0.1.2 or later in every environment that consumes user-provided prompt data.
- Audit all call sites of lf.query and replace the default Python protocol with a structured schema protocol such as JSON where possible.
- Restrict network egress from hosts running langfun to only the endpoints required by the application.
- Run LLM application processes under a dedicated low-privilege service account with no write access to source or secrets.
Patch Information
The issue is fixed in Google langfun version 0.1.2. Upgrade via pip install --upgrade langfun>=0.1.2 and rebuild container images and serverless bundles that pin the vulnerable release. Verify installed versions in production with pip show langfun. See the langfun GitHub repository for release notes and the GitHub issue #725 discussion for maintainer context.
Workarounds
- Switch lf.query invocations to a non-evaluating output protocol, for example a JSON or schema-validated protocol, until the upgrade is deployed.
- Wrap langfun calls in a subprocess sandbox with seccomp, nsjail, or a container that denies execve and outbound sockets.
- Apply strict input filtering on prompt inputs to reject content that requests code, imports, or shell commands, while treating this as defense in depth rather than a fix.
# Upgrade langfun to the patched release
pip install --upgrade 'langfun>=0.1.2'
# Verify the installed version
pip show langfun | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
