Description
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.
Published: 2026-08-26
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an eval injection flaw in the default lf.query Python protocol of Google langfun. An attacker who can send a prompt to the model can cause the system to generate a Python expression that is then evaluated with the process’s full permissions. This flaw provides remote unauthenticated execution of arbitrary Python code, classified under CWE-1188 (Improper Neutralization of Directives) and CWE-95 (Improper Neutralization of Code).

Affected Systems

Google langfun versions earlier than 0.1.2 that expose the default lf.query protocol are affected. Any deployment that has enabled this protocol and is still running a pre‑0.1.2 release is at risk.

Risk and Exploitability

The CVSS score of 9.2 marks this issue as critical. The EPSS score is not provided, so the current exploitation likelihood cannot be quantified. The bug is exploitable remotely without any authentication, simply by sending a crafted prompt that prompts the model to return code evaluable by the host. Because the evaluation occurs without a sandbox, the attacker can gain control of the host process and potentially compromise confidentiality, integrity, and availability.

Generated by OpenCVE AI on August 26, 2026 at 17:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google langfun to version 0.1.2 or later to apply the patch that removes unsafe eval usage.
  • If upgrading is not possible, disable or remove the default lf.query protocol from the application so that no dynamic code evaluation is performed.
  • Consider implementing an additional sandbox or execution guard around any remaining eval-like functionality to prevent untrusted code from accessing critical resources.

Generated by OpenCVE AI on August 26, 2026 at 17:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.
Title Eval Injection in google/langfun via default lf.query protocol
Weaknesses CWE-1188
CWE-95
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Google

Published:

Updated: 2026-08-26T15:38:02.455Z

Reserved: 2026-08-17T15:35:22.670Z

Link: CVE-2026-75062

cve-icon Vulnrichment

Updated: 2026-08-26T15:37:58.264Z

cve-icon NVD

Status : Received

Published: 2026-08-26T15:16:55.853

Modified: 2026-08-26T16:16:38.220

Link: CVE-2026-75062

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T17:15:04Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-95

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')