GHSA-q9p7-wqxg-mrhc: Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Summary

Langroid's TableChatAgent and VectorStore evaluate LLM-generated tool messages with eval() when full_eval=True, passing an empty dictionary as locals. Because __builtins__ is not removed from the globals mapping, expressions such as __import__('os').system(...) execute, allowing a prompt-injected attacker to achieve unauthenticated remote code execution on the host. The flaw is located in /langroid/agent/special/table_chat_agent.py around line 239 and /langroid/vector_store/base.py around line 225.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langroidPyPILLM dependency since 2023-07-14

Related items

• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer
• InfoAnthropic Warns Small AI Models Could Soon Form Self-Propagating IoT BotnetsSimilar attack · The Hacker News
• InfoAgent Baseline Publishes Security Reference Architecture for Software FactoriesSimilar attack · Socket Blog