PT-2025-22277 · Langroid · Langroid

Sch227 · Published 2025-05-20 · Updated 2025-08-13 · CVE-2025-46725

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.53.15

Description The issue concerns the use of pandas eval() through the compute from docs() function in the LanceDocChatAgent component. This allows an attacker to potentially run malicious commands, compromising the host system. The QueryPlan.dataframe calc is also implicated in this issue.

Recommendations For versions prior to 0.53.15, consider disabling the LanceDocChatAgent component or restricting its use until the issue is resolved. As a temporary workaround, avoid using the compute from docs() function and the QueryPlan.dataframe calc to minimize the risk of exploitation. Update to version 0.53.15 or later, which sanitizes input to the affected function by default and includes warnings about risky behavior in the project documentation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-46725

GHSA-22C2-9GWG-MJ59

Affected Products

Langroid

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46725.json · Exploit
• https://github.com/langroid/langroid/commit/0d9e4a7bb3ae2eef8d38f2e970ff916599a2b2a6 · Patch
• https://github.com/langroid/langroid/security/advisories/GHSA-22c2-9gwg-mj59 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-22c2-9gwg-mj59 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46725 · Security Note
• https://github.com/langroid/langroid · Note
• https://t.me/cvetracker/24323 · Telegram Post
• https://t.me/cveNotify/132096 · Telegram Post
• https://t.me/latest_high_impact_cve/2428 · Telegram Post
• https://twitter.com/CVEnew/status/1924885491637485634 · Twitter Post