CVE Details
Basic Information
| Title |
CVE-2025-46724 |
| Type |
cve |
| Published |
2025-05-20T18:15:46 |
| Last Seen |
2025-05-20T18:26:46 |
CVSS Information
| Base Score |
9.8 (CRITICAL) |
| Attack Vector |
NETWORK |
| Attack Complexity |
LOW |
| Privileges Required |
NONE |
| User Interaction |
NONE |
| Scope |
UNCHANGED |
| Confidentiality Impact |
HIGH |
| Integrity Impact |
HIGH |
| Availability Impact |
HIGH |
AI Analysis
| AI Description |
Langroid’s TableChatAgent uses pandas eval() which can execute arbitrary code if fed untrusted user input, posing a critical risk in public-facing LLM applications. |
| AI Severity |
Critical |
| Vendor |
Langroid Community |
| Product |
Langroid |
| Affected Version |
0.53.15 and prior |
Additional Information
| CVE List |
CVE-2025-46724 |
| CWE List |
CWE-94 |
| Bulletin Family |
cve |
Description
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, TableChatAgent uses pandas eval(). If fed by untrusted user input, like the case of a public-facing LLM application, it…
CVSS Score Summary
Base Score: %!f(string=#) (CRITICAL)
View Full CVE Details
