# CVE-2026-25481: Langroid RCE via WAF bypass in TableChatAgent

Source: https://junglewise.ai/threats/cve-2026-25481-langroid-rce-via-waf-bypass-in-tablechatagent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-02. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-25481 · Severity: critical · CVSS 4 · Published 2026-02-02

Langroid, a framework for building LLM-based applications, contains a vulnerability in its data analysis component that allows attackers to execute arbitrary commands on the underlying server. By providing a specially crafted request to the TableChatAgent, an attacker can bypass security filters intended to block malicious code. This could lead to a full system compromise, unauthorized data access, or service disruption.

Technologies: [langroid (PyPI)](https://junglewise.ai/threats/technologies/langroid). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-25481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25481 being exploited in the wild.

**How severe is CVE-2026-25481?** Critical severity, with a CVSS score of 4, published 2 February 2026.

**Which products and versions are affected?** langroid (PyPI) <= 0.59.31, ECOSYSTEM:introduced=0,fixed=0.59.32.

**Is there a fix for CVE-2026-25481?** Yes. langroid (PyPI): upgrade to 0.59.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25481 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25481?** Check whether you run langroid (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langroid (PyPI): upgrade to 0.59.32 or later

  ```sh
  pip install "langroid>=0.59.32"
  ```


## Technical details

A Remote Code Execution (RCE) vulnerability exists in Langroid's TableChatAgent due to a bypass of the WAF implemented in `langroid/utils/pandas_utils.py`. The root cause is twofold: the `_literal_ok()` function returns `False` instead of raising an `UnsafeCommandError` on invalid input, and the system fails to restrict access to dangerous Python dunder attributes like `__init__`, `__globals__`, and `__builtins__`. An attacker can chain whitelisted DataFrame methods to access the `eval` builtin and execute arbitrary shell commands. This vulnerability is a bypass of the fix for CVE-2025-46724 and is tracked as CVE-2026-25481. A patch is available in version 0.59.32.

## Affected products

- langroid langroid <= 0.59.31

## Identifiers

- CVE-2026-25481
- GHSA-x34r-63hx-w57f
- PYSEC-2026-383

## Timeline

- 2026-02-01: patched: Fixed in version 0.59.32
- 2026-02-02: advisory: GHSA-x34r-63hx-w57f published

## References

- [https://api.github.com/users/Ka7arotto](https://api.github.com/users/Ka7arotto)
- [https://github.com/Ka7arotto](https://github.com/Ka7arotto)
- [https://api.github.com/users/Ka7arotto/gists%7B/gist_id%7D](https://api.github.com/users/Ka7arotto/gists%7B/gist_id%7D)
- [https://api.github.com/users/Ka7arotto/repos](https://api.github.com/users/Ka7arotto/repos)
- [https://avatars.githubusercontent.com/u/145242956?v=4](https://avatars.githubusercontent.com/u/145242956?v=4)
- [https://api.github.com/users/Ka7arotto/events%7B/privacy%7D](https://api.github.com/users/Ka7arotto/events%7B/privacy%7D)

## Related threats

- [Langroid prompt injection in Neo4jChatAgent and ArangoChatAgent](https://junglewise.ai/threats/cve-2026-55615-langroid-prompt-injection-in-neo4jchatagent-and-arangochatagent)
- [Langroid unauthorized tool invocation via raw JSON payloads](https://junglewise.ai/threats/cve-2026-54771-langroid-unauthorized-tool-invocation-via-raw-json-payloads)
- [Langroid sandbox escape and RCE in TableChatAgent and VectorStore](https://junglewise.ai/threats/cve-2026-54769-langroid-sandbox-escape-and-rce-in-tablechatagent-and-vectorstore)
- [Langroid SQLChatAgent regex bypass in SQL injection mitigation](https://junglewise.ai/threats/cve-2026-54760-langroid-sqlchatagent-regex-bypass-in-sql-injection-mitigation)
- [Langroid path traversal in ReadFileTool and WriteFileTool](https://junglewise.ai/threats/cve-2026-50181-langroid-path-traversal-in-readfiletool-and-writefiletool)