CVE-2025-46724

CVE-2025-46724 describes a critical code injection vulnerability in Langroid, a Python framework for LLM applications, affecting versions prior to 0.53.15. Specifically, the TableChatAgent component's use of pandas eval() can be exploited if processing untrusted user input in public-facing applications. With a CVSS score of 9.8 (CRITICAL), this vulnerability allows for complete compromise of confidentiality, integrity, and availability with low attack complexity and no user interaction required. While no active exploitation, public exploit code, or significant community discussion has been observed, the vendor has released version 0.53.15 to sanitize input and mitigate common attack vectors.