Hamza Haroon

**Name of the Vulnerable Software and Affected Versions** langfun versions prior to 0.1.2 **Description** An Eval Injection occurs in the default `lf.query` Python protocol. This issue allows remote unauthenticated attackers to execute arbitrary Python code within the host application context. The flaw is triggered when crafted prompt inputs lead the model to generate executable Python expressions that are evaluated without a sandbox. Eval Injection is a flaw where untrusted input is passed to a code evaluation function, allowing the execution of unauthorized commands. **Recommendations** Update langfun to version 0.1.2 or later. As a temporary mitigation, restrict the use of the `lf.query` protocol to prevent the evaluation of untrusted prompt inputs.

**Name of the Vulnerable Software and Affected Versions** genql versions prior to 6.3.4 **Description** An authenticated attacker who can control the GraphQL schema passed to genql can inject arbitrary JavaScript or TypeScript. This malicious code is inserted into the generated `schema.ts` file and is executed when the genql client is bundled and imported. **Recommendations** Update to version 6.3.4 or later.