CVE-2026-25481 is a critical code injection flaw (CVSS 9.6) in Langroid, a Python framework for LLM applications. It bypasses the fix for CVE-2025-46724 in the pandas_eval tool used by TableChatAgent. Versions before 0.59.32 are affected, and 0.59.32 fixes it. Upgrade and rebuild any images that pin the old version.
What's affected
- Package: langroid on PyPI.
- Affected: versions before 0.59.32, per the NVD description.
- Fixed: 0.59.32.
- Exposure: applications that use TableChatAgent and let it evaluate expressions.
- Note: the GitHub advisory entries for this family list earlier ranges, so confirm your version against both advisories listed below.
How to check if you're exposed
Check the installed version in each environment and container image:
pip show langroid
pip freeze | grep -i langroid
Then search your code for TableChatAgent. If you do not use it, the vulnerable path is probably not reachable, but upgrade anyway because the library is a direct dependency.
What to do now
- Upgrade to langroid 0.59.32 or later and rebuild images.
- Pin the version in requirements or your lockfile and redeploy.
- Run TableChatAgent only on trusted data, and treat user supplied prompts as untrusted input.
- Run the agent process with minimal privileges, no cloud credentials in the environment and restricted network access.
- Re-scan after the upgrade to confirm the old version is gone from every layer.
Why it matters
The first fix added an allow list filter in langroid/utils/pandas_utils.py. The advisory says the filter could be bypassed because one check returned False instead of raising an error on invalid input, and because dangerous dunder attributes were still reachable. Chaining permitted DataFrame methods then exposed the eval builtin. The class is code injection, CWE-94.
Patching a filter after a bypass is a known pattern. Allow lists around eval are hard to get right, which is why the safer design is to avoid evaluating model generated expressions in the host process at all. The record does not mark this CVE as exploited in the wild.
How to prioritise the fix
Start with where Langroid runs. Agent frameworks tend to be installed in notebooks, internal tools and prototype services that nobody put on the main inventory list, so search container images, virtual environments and requirements files, not only the repositories you consider production.
Then decide how much you trust the inputs. TableChatAgent turns a model's output into an expression to evaluate against a table. If a user can steer the prompt, they can steer the expression. Where users are outside your company, upgrade today. Where only a few trusted analysts use the tool, upgrade this week and plan for isolation.
A dependency scan answers the first question, which is whether the package is present at all. Reachability analysis answers the second, which is whether your code calls the vulnerable path. You can start with the free scan at gold.safeguard.sh/scan and then read the Gold entry for this CVE to see affected ranges.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does a fix for a previous CVE matter here?
The earlier patch for CVE-2025-46724 was incomplete. If you upgraded for that one but stopped below 0.59.32, you are still exposed.
Is a transitive dependency enough to be at risk?
The vulnerable code needs to be reached. Reachability analysis helps tell you whether your app ever calls TableChatAgent.
Sources
Last reviewed: 19 October 2026.
