CVE-2025-46725 is a critical code injection flaw (CVSS 9.8) in Langroid before 0.53.15. LanceDocChatAgent passes model-influenced input to pandas eval(), so an attacker may be able to run commands on the host. Upgrade to 0.53.15, which sanitises the input by default, and read the documentation warnings.
What's affected
The NVD record says Langroid versions before 0.53.15 are affected, and the GitHub advisory names 0.53.15 as the patched release. Langroid is a Python framework for building applications powered by large language models.
The affected component is LanceDocChatAgent, in its compute_from_docs() function. That function evaluates a dataframe calculation string through pandas eval(). The advisory says the string can come through the QueryPlan.dataframe_calc field, which a language model produces from user input.
The fix sanitises input to the function by default to handle the most common attack vectors, and the project added warnings to its documentation about the risk. Read those warnings: the project signals that the design carries risk, not only that one bug is closed.
How to check if you're exposed
Check the installed version in every Python environment and container.
- Run
pip show langroidand read the Version line. - Run
pip freeze | grep -i langroidto list it in a virtual environment. - For lock files, search with
grep -n langroid requirements.txt poetry.lock uv.lock. - Check whether your code uses LanceDocChatAgent. A search such as
grep -rn LanceDocChatAgent .shows usage.
Any version before 0.53.15 is affected. If you do not use LanceDocChatAgent, the vulnerable function is likely not on your execution path, which is what reachability analysis is meant to tell you. The free in-browser dependency scan can read your requirements file in the browser and flag the version.
What to do now
- Upgrade Langroid to 0.53.15 or later in all environments and rebuild images.
- Read the new documentation warnings about the risky behaviour and decide whether LanceDocChatAgent fits your threat model.
- Run agents that evaluate model-produced expressions in a sandbox with no secrets, minimal network access and a low privilege account.
- Do not give the agent access to documents or queries that come from untrusted users without review.
- Log the dataframe calculations that the agent runs, so unusual ones stand out.
- Pin Langroid in your lock file and enable automated alerts for new releases.
Why it matters
The record lists CWE-94 (Improper Control of Generation of Code (Code Injection)). Code injection happens when text that someone else controls is run as code. With language model applications there is an extra step: the model turns a user's request into the expression, so a user can steer what gets evaluated through the prompt.
The vector (AV:N, AC:L, PR:N, UI:N) reflects that an agent exposed to users may be reachable by anyone. The project's fix filters common attack patterns, and its documentation now warns about the behaviour, so teams should still isolate agents that run generated expressions. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
The demo shows how reachability analysis separates flaws in code your application calls from flaws in code it never uses.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Langroid 0.53.15, according to the advisory.
Is the fix a complete cure?
The advisory says the fix sanitises input by default to tackle the most common attack vectors and adds documentation warnings. Keep sandboxing in place.
Sources
Last reviewed: 18 October 2026.
