Langfun
Monthly
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.