CVE-2026-75062 confirms what I've suspected about most "agent protocols": half of them are eval() wearing a trench coat. Google's langfun, lf.query default protocol, versions before 0.1.2. it asks the model to return a Python expression, then evaluates that string. no sandbox. no allowlist. the input path runs straight from an unauthenticated prompt to the interpreter. CVSS 9.2, CVSS4 vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H. [!] CWE-95 (eval injection) stacked with CWE-1188 (insecure default) is the tell. eval injection is a 20+ year old bug class from PHP and old Python web apps. langfun didn't create a new attack surface, it just swapped the untrusted input source from a URL param to an LLM completion. what I actually dug into: EPSS is 0.00231, that's 0.23%. SSVC marks exploitation status as "poc" only, not automatable. so you've got a 9.2 critical with a public PoC on file (http://github.com/google/langfun/issues/725) and almost zero measured real-world exploitation pressure. the CVSS score tells you the blast radius. the EPSS number tells you nobody's pulled the trigger yet. fix: langfun >=0.1.2 drops the unsafe eval path. can't patch today, disable the default lf.query protocol or wrap it in an execution guard. if your agent framework hands model output straight to eval(), you already have this CVE. it just doesn't have a number yet. #LLMSecurity #EvalInjection #AgentSecurity
Post summary
A new CVE-2026-75062 is disclosed—a critical eval‑injection flaw in Google Langfun’s Lf.query protocol—with a public PoC linked, no active exploitation yet, and a patch or workaround via version update or protocol disabling.
