CVE-2025-46725

CVE-2025-46725 is a critical vulnerability affecting Langroid, a Python framework for LLM applications, specifically versions prior to 0.53.15. The vulnerability stems from the LanceDocChatAgent's use of pandas eval() within compute_from_docs(), allowing an attacker to inject and execute malicious commands via QueryPlan.dataframe_calc. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While Langroid version 0.53.15 addresses this by sanitizing input and adding warnings, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.