CVE-2026-75062: Eval Injection in google/langfun via default lf.query protocol
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
google/langfunto a version that resolves this vulnerability.Fixed in 0.1.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Google langfun versions prior to 0.1.2 with the default lf.query Python protocol are exposed. The vulnerable behavior evaluates model-generated Python expressions in the host application's context.
What does an attacker need to exploit it?
An attacker only needs to be able to provide crafted prompt inputs. Exploitation does not require authentication and can result in arbitrary Python code execution in the host application context.
Is the default configuration affected?
Yes. The issue is specifically in the default lf.query Python protocol, so deployments using that default protocol are affected in versions before 0.1.2.
What should be done if patching is not immediately possible?
The provided information identifies the default lf.query Python protocol as the affected component, but does not provide a documented workaround. Avoiding use of that protocol would remove the described evaluation path, where operationally feasible.