Langroid’s TableChatAgent allows evaluation of user‑supplied expressions via pandas_eval. A bypass in the framework’s WAF removes protection originally intended for CVE‑2025‑46724, because _literal_ok incorrectly returns False rather than throwing an UnsafeCommandError. The code also exposes dangerous dunder attributes such as __init__, __globals__, and __builtins__, letting an attacker chain whitelisted DataFrame methods to access the eval builtin. This flaw enables execution of arbitrary code, making it a classic code injection problem (CWE‑94).

All installations of the Langroid framework built before version 0.59.32 are affected. This includes the langroid product from the langroid vendor. Systems using earlier releases should check their installed version and consider an upgrade.

The vulnerability carries a CVSS 9.4 score, indicating a high severity of Remote Code Execution. EPSS is less than 1 %, suggesting that exploitation is unlikely to be widespread, and the issue is not yet listed in the CISA KEV catalog. An attacker would need to control input to the TableChatAgent component; once triggered, the bypass allows arbitrary code to run with the privileges of the process hosting the agent. Given the high impact and the low current probability of exploitation, organizations should treat this as a critical patchability risk.