Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in langroid/utils/pandas_utils.py introduced to block code injection CVE-2025-46724. However it can be bypassed due to _literal_ok() returning False instead of raising UnsafeCommandError on invalid input, combined with unrestricted access to dangerous dunder attributes (__init__, __globals__, __builtins__). This allows chaining whitelisted DataFrame methods to leak the eval builtin and execute arbitrary code. This issue has been patched in version 0.59.32.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-03 | 1 | Patch1 |
| 2026-02-04 | 2 | Disclosure1Patch1 |
CVE-2026-25481 Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. TableChatAg… https://www.cve.org/CVERecord?id=CVE-2026-25481
Post summary
CVE-2026-25481 is addressed in Langroid version 0.59.32, with earlier versions containing a bypass to the fix for CVE-2025-46724.
🚨 CVE-2026-25481: Langroid has WAF Bypass Leading ... Langroid's WAF fails spectacularly with a logic flaw in _literal_ok() that lets attackers chain DataFrame methods to le... https://zerodaysignal.com/vulnerability/CVE-2026-25481 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
Langroid's WAF bypass (CVE‑2026‑25481) is due to a logic flaw in _literal_ok(), permitting method chaining, but the post lacks PoC, exploit code, patch info, or evidence of active exploitation.
Langroid's TableChatAgent has a WAF bypass leading to RCE (CVE-2026-25481). Update to 0.59.32. Review deployments for exposure. #Langroid #RCE #infosec https://www.pulsepatch.io/posts/cve-2026-25481-langroid-waf-bypass-rce
Post summary
The post announces a CVE-2026-25481 vulnerability in Langroid TableChatAgent, warns of RCE via a WAF bypass, and recommends updating to 0.59.32 to mitigate the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langroid | langroid | - | - | - |