Executive brief
Google's langfun is a Python library that integrates language models into applications by treating natural language as executable functions. The default configuration executes model-generated responses as Python code without a sandbox, allowing attackers who can influence model inputs (via prompt injection) to execute arbitrary Python commands in the host process—reading secrets, accessing files, and making network requests.
Technical details
The vulnerability is an eval injection (CWE-94/95) in the default lf.query Python protocol handler. When lf.query() is called with schema parameter, it parses the model's response by executing it as Python via pyglove.coding.evaluate with sandbox=False and a permissive AST filter (CodePermission.ASSIGN|CALL) that does not restrict which names or builtins may be called. The attack vector is network-adjacent: an attacker must influence the model's input (via prompt injection in user-supplied documents, tool outputs, or web content fed to a RAG application or agent), but requires no authentication. The library's documentation does not indicate code execution is involved, and the AST permission filter creates a false sense of security. An attacker-controlled prompt injection produces malicious model output that executes silently as Python within the host process, with no observable error or log, granting full process privileges.
Affected products
- Google langfun prior to 0.1.2
Timeline
- 2026-05-30: disclosed: Reported to Google OSS VRP and filed as public GitHub issue #725
- 2026-08-26: advisory