langfun CVE-2026-75062

Exploitation requires the target application to use langfun (version < 0.1.2) with its default lf.query Python protocol - the code-generating/eval path - and to route attacker-influenced content into that query. The concrete prerequisite is that untrusted prompt text reaches lf.query while the Python protocol (unsandboxed evaluation of model output) is in use, which is the default. Limiting factors: exploitation is probabilistic because it hinges on the model being steered into emitting executable Python (reflected as AT:P in the CVSS 4.0 vector), and applications that never expose lf.query to untrusted input, or that have moved to a non-eval structured output path, are not exploitable. No user interaction or authentication is required (UI:N, PR:N).

The signals are largely consistent and point to a genuine high priority, with one important nuance. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) shows a network-reachable, low-complexity, unauthenticated path to full impact - but the AT:P (attack requirements present) metric is the key qualifier: successful exploitation depends on the LLM actually generating attacker-controlled executable Python, which is probabilistic rather than deterministic. This is why the 9.2 score, though CRITICAL, is not a clean 10. No EPSS score, KEV listing, or POC is provided, so there is no evidence of active exploitation or a published exploit; the danger is architectural (unsandboxed eval of model output) rather than demonstrated in the wild. Note a data gap: EPSS is absent, so quantitative exploitation likelihood cannot be compared against the CVSS severity. Given langfun is an emerging-technology building block for AI agents, organizations that expose lf.query to untrusted prompts - from a large cloud operator down to a small AI product team - should treat unsandboxed code evaluation as urgent and patch promptly, while recognizing that mass, automated exploitation is constrained by the probabilistic AT:P factor.

An attacker submits a crafted prompt to an application that forwards user input into langfun's default lf.query Python protocol; the input coaxes the backing model into emitting a Python expression containing malicious code (for example an os.system or import call), which langfun evaluates without a sandbox and thereby executes on the server. No authentication is required (PR:N) and the attack is network-borne (AV:N), though success depends on the model actually producing the executable payload (AT:P). No public POC is identified at time of analysis.