CVE-2026-54769
CWE-94Published: July 10, 2026· Updated: Jul 10, 2026
Official Description
Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python's `eval()` function. However, this relies on an incomplete understanding of Python's execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__('os').system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. Version 0.65.2 patches the issue.
Risk Analysis
Langroid, a framework for LLM applications, is vulnerable to a critical sandbox escape in its TableChatAgent and VectorStore capabilities, leading to remote code execution. Versions prior to 0.65.2 fail to properly sandbox Python's eval() function, allowing attackers to access built-in functions like os.system(). This vulnerability has a CVSSv3.1 score of 10.0, indicating maximum severity.
No public exploit is currently known for this vulnerability. The flaw is remotely exploitable without authentication, making it a high-risk target if an exploit emerges.
Upgrade Langroid to version 0.65.2 or later to fix this sandbox escape. Ensure that any code execution within LLM applications is thoroughly sandboxed and that built-in functions are explicitly restricted.
Technical Analysis
CVE-2026-54769 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 10.0.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-94)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-54769 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts