Executive brief
Langroid is a Python library for building AI agents with vector database support. The LanceDocChatAgent component uses pandas' eval() function to perform calculations on document data, allowing attackers to inject arbitrary Python code through maliciously crafted query parameters. A successful attack could give an attacker complete control over the host system running the affected application.
Technical details
The vulnerability is a code injection flaw in the compute_from_docs() method of the vector_store module, which uses pandas.eval() with user-supplied input to execute dataframe calculations. The vulnerable code path is reachable through QueryPlan.dataframe_calc parameters, which are not properly sanitized before being passed to pd.eval(). An unauthenticated attacker with network access to an application using LanceDocChatAgent can exploit this by crafting malicious calculation expressions that execute arbitrary Python code on the host system. The fix in version 0.53.15 adds input sanitization and documentation warnings about the risky behavior.
Affected products
- Langroid Langroid before 0.53.15
Timeline
- 2025-05-20: disclosed
- 2025-05-20: patched: Version 0.53.15 released with input sanitization