CVE-2026-54769 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-54769 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-54769 is a critical sandbox escape in Langroid that can lead to unauthenticated remote code execution (RCE) on hosts running vulnerable versions. The issue affects Langroid’s TableChatAgent and VectorStore paths when full_eval=True is used to evaluate LLM-generated tool messages. Versions prior to 0.65.2 are vulnerable.

For solo developers and small teams, this is an urgent patch-now issue: if your app accepts prompts, tool outputs, or agent messages that can reach these code paths, an attacker may be able to execute arbitrary Python commands on your server. Upgrade immediately to 0.65.2 and temporarily disable any feature that evaluates model-generated code until you have verified the fix.

Immediate Action

  • Patch now: upgrade Langroid to 0.65.2 or later in every environment, including dev, staging, and production.
  • Disable risky features: turn off full_eval=True and any agent flow that evaluates LLM-generated tool messages until patched.
  • Isolate the service: if the app is internet-facing, place it behind auth, restrict inbound access, and run it in a locked-down container or VM.
  • Rotate secrets: assume API keys, tokens, and environment secrets may be exposed if the service was reachable by untrusted users.
  • Check vendor guidance: review the Langroid release notes / advisory page for 0.65.2 or later: TODO: vendor advisory link.

Affected Versions

  • langroid<0.65.2 vulnerable; upgrade to 0.65.2+
  • TableChatAgent with full_eval=True vulnerable in affected versions
  • VectorStore paths that evaluate LLM-generated tool messages vulnerable in affected versions
  • Safe version: langroid==0.65.2 or any newer release that includes the patch

Resolution Guide

Python / pip

pip install --upgrade "langroid==0.65.2"

Python / pipx (if installed in an isolated tool environment)

pipx upgrade langroid
# If your project pins dependencies, still update the project lockfile to 0.65.2+

JavaScript / npm, yarn, pnpm

Langroid is a Python package, so there is no direct npm/yarn/pnpm install path. If your app is a mixed stack, update the Python dependency in the backend service and rebuild the deployment image.

Java / Maven, Gradle

Langroid is not a Java dependency. If you proxy or wrap a Python service from Java, update the Python runtime package in that service image or virtualenv.

Linux package managers

There is no apt/yum package for Langroid itself. Update the Python environment used by the service.

Docker image tags

# Rebuild using a patched requirements file
docker build --no-cache -t yourapp:patched .

# Example requirements.txt pin
langroid==0.65.2

Config hardening

# Disable evaluation of model-generated code until patched
full_eval = False

# Prefer a non-executing path for table/vector workflows
# Example: route to read-only retrieval or manual review
agent_mode = "read_only"

Minimal code fix example

# Before: dangerous evaluation of LLM-generated content
result = eval(tool_message, {}, {})

# Safer pattern: do not eval untrusted model output
raise RuntimeError("LLM-generated code execution disabled")

# If you must evaluate trusted expressions, use a strict parser/allowlist
# and explicitly remove builtins from globals:
safe_globals = {"__builtins__": {}}
safe_locals = {}
# eval(trusted_expression, safe_globals, safe_locals)  # only for trusted input

Detection & Verification

Check installed version

python -c "import langroid; print(langroid.__version__)"

Find vulnerable settings in code

grep -RIn "full_eval\s*=\s*True\|pandas_eval\|eval(" .

Check dependency lockfiles

grep -RIn "langroid" requirements.txt requirements*.txt pyproject.toml poetry.lock uv.lock Pipfile.lock

Dependency audit

pip show langroid
pip freeze | grep -i langroid

Verify the fix

python -c "import langroid; assert langroid.__version__ >= '0.65.2'; print('patched')"
python -c "import langroid; print('full_eval disabled in config' if not getattr(langroid, 'full_eval', True) else 'check config')"

Runtime verification: confirm your app no longer evaluates raw LLM tool output and that any agent path using TableChatAgent or VectorStore is either patched or disabled.

Risk and Impact

This flaw can let an attacker turn a prompt into arbitrary shell commands on the server, with no prior authentication required if the vulnerable agent is exposed. The blast radius includes source code, credentials, databases, internal network access, and any cloud resources reachable from the host. For small teams, the biggest risk is fast compromise through an internet-facing demo, webhook, chatbot, or internal tool that was assumed to be “sandboxed.”

Keep reading