{"data":{"id":"08c36733-b677-42e6-b4c6-e0adf8cc25c3","title":"CVE-2026-75062: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python…","summary":"CVE-2026-75062 is an Eval Injection flaw (CWE category: Improper Neutralization of Directives in Dynamically Evaluated Code) in the default lf.query Python protocol of Google langfun, affecting versions prior to 0.1.2. Remote unauthenticated attackers can use crafted prompt inputs to make the model generate Python expressions, which are evaluated without a sandbox, letting them execute arbitrary Python code in the context of the host application.","solution":"Fixed in 0.1.2 (langfun versions prior to 0.1.2 are affected).","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75062","publishedAt":"2026-08-26T15:16:55.853Z","cveId":"CVE-2026-75062","cweIds":["CWE-95","CWE-1188"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["jailbreak","other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google"],"affectedVendorsRaw":["Google langfun"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Google langfun eval injection in default lf.query Python protocol","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0035,"epssCheckedAt":"2026-11-04T18:09:13.386Z","kevDateAdded":null,"advisoryAliases":["GHSA-8x83-862f-c85r"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-02T00:08:53.482Z","patchAvailable":null,"disclosureDate":"2026-08-26T15:16:55.853Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0054"],"fixes":[]}}