# CVE-2026-54769: Langroid sandbox escape and RCE in TableChatAgent and VectorStore

Source: https://junglewise.ai/threats/cve-2026-54769-langroid-sandbox-escape-and-rce-in-tablechatagent-and-vectorstore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-54769 · Severity: critical · CVSS 10 · Published 2026-07-10

Langroid, a framework for building AI-powered applications, contains a security flaw that allows attackers to bypass its safety sandbox. By sending a specially crafted prompt to an AI agent, an attacker can execute malicious commands directly on the underlying server. This could lead to a total system takeover, unauthorized data access, or service disruption.

Technologies: [langroid (PyPI)](https://junglewise.ai/threats/technologies/langroid). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54769 being exploited in the wild.

**How severe is CVE-2026-54769?** Critical severity, with a CVSS score of 10, published 10 July 2026.

**Which products and versions are affected?** langroid (PyPI) <= 0.65.1, ECOSYSTEM:introduced=0,fixed=0.65.2.

**Is there a fix for CVE-2026-54769?** Yes. langroid (PyPI): upgrade to 0.65.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54769 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54769?** Check whether you run langroid (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langroid (PyPI): upgrade to 0.65.2 or later

  ```sh
  pip install "langroid>=0.65.2"
  ```


## Technical details

A sandbox escape vulnerability exists in Langroid's `TableChatAgent` and `VectorStore` components when `full_eval=True` is enabled. The framework attempts to sandbox LLM-generated tool messages by passing an empty dictionary to the `locals` parameter of Python's `eval()` function; however, it fails to scrub `__builtins__` from the `globals` dictionary. This allows an attacker to use prompt injection to trigger a tool call that accesses restricted functions like `__import__('os').system()`. An unauthenticated remote attacker can achieve full code execution on the host system by providing a malicious prompt payload. The issue is addressed in version 0.65.2.

## Affected products

- langroid langroid < 0.65.2

## Identifiers

- CVE-2026-54769
- GHSA-q9p7-wqxg-mrhc
- PYSEC-2026-2581

## Timeline

- 2026-06-09: advisory: GitHub advisory published by maintainers
- 2026-07-09: disclosed: NVD publication date
- 2026-07-10: patched: Fix available in version 0.65.2

## References

- [https://github.com/langroid/langroid/security/advisories/GHSA-q9p7-wqxg-mrhc](https://github.com/langroid/langroid/security/advisories/GHSA-q9p7-wqxg-mrhc)

## Related threats

- [Langroid prompt injection in Neo4jChatAgent and ArangoChatAgent](https://junglewise.ai/threats/cve-2026-55615-langroid-prompt-injection-in-neo4jchatagent-and-arangochatagent)
- [Langroid unauthorized tool invocation via raw JSON payloads](https://junglewise.ai/threats/cve-2026-54771-langroid-unauthorized-tool-invocation-via-raw-json-payloads)
- [Langroid SQLChatAgent regex bypass in SQL injection mitigation](https://junglewise.ai/threats/cve-2026-54760-langroid-sqlchatagent-regex-bypass-in-sql-injection-mitigation)
- [Langroid path traversal in ReadFileTool and WriteFileTool](https://junglewise.ai/threats/cve-2026-50181-langroid-path-traversal-in-readfiletool-and-writefiletool)
- [Langroid SQLChatAgent arbitrary file read via SQL blocklist bypass](https://junglewise.ai/threats/cve-2026-50180-langroid-sqlchatagent-arbitrary-file-read-via-sql-blocklist)