Executive brief
Langroid, a framework for building AI-powered applications, contains a security flaw that allows attackers to bypass its safety sandbox. By sending a specially crafted prompt to an AI agent, an attacker can execute malicious commands directly on the underlying server. This could lead to a total system takeover, unauthorized data access, or service disruption.
Technical details
A sandbox escape vulnerability exists in Langroid's `TableChatAgent` and `VectorStore` components when `full_eval=True` is enabled. The framework attempts to sandbox LLM-generated tool messages by passing an empty dictionary to the `locals` parameter of Python's `eval()` function; however, it fails to scrub `__builtins__` from the `globals` dictionary. This allows an attacker to use prompt injection to trigger a tool call that accesses restricted functions like `__import__('os').system()`. An unauthenticated remote attacker can achieve full code execution on the host system by providing a malicious prompt payload. The issue is addressed in version 0.65.2.
Affected products
- langroid langroid < 0.65.2
Timeline
- 2026-06-09: advisory: GitHub advisory published by maintainers
- 2026-07-09: disclosed: NVD publication date
- 2026-07-10: patched: Fix available in version 0.65.2