A sandbox escape flaw in the Agent or VectorStore components to execute arbitrary code, because the framework forgets to remove built‑in functions from the globals dictionary before calling Python’s eval() on LLM‑generated tool messages. This issue is a classic code injection vulnerability, CWE‑94, that can be satisfied with a short payload built into a user prompt. Attackers can supply that payload that runs Langroid, thereby obtaining perfect remote code execution privileges.

The Langroid Python library, any application that imports langroid:langroid and uses TableChatAgent or VectorStore with full_eval=True, is affected. All users of versions earlier than 0.65.2 must review their deployments. The flaw does not appear in releases 0.65.2 and later, where the fixed code properly sanitizes built‑ins.

The CVSS score of 10 indicates maximum severity, and the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation vulnerability is not listed in the CISA KEV catalog. A patch is available in Langroid version 0.65.2; until updated, an attacker can exploit the flaw by crafting Vector LLM‑generated tool messages with eval(). The attack requires the TableChatAgent or VectorStore to be invoked with full_eval=True, no additional privileges or components are necessary.