Pypi · Langfun · CVE-2026-75062
**Name of the Vulnerable Software and Affected Versions**
langfun versions prior to 0.1.2
**Description**
An Eval Injection occurs in the default `lf.query` Python protocol. This issue allows remote unauthenticated attackers to execute arbitrary Python code within the host application context. The flaw is triggered when crafted prompt inputs lead the model to generate executable Python expressions that are evaluated without a sandbox. Eval Injection is a flaw where untrusted input is passed to a code evaluation function, allowing the execution of unauthorized commands.
**Recommendations**
Update langfun to version 0.1.2 or later.
As a temporary mitigation, restrict the use of the `lf.query` protocol to prevent the evaluation of untrusted prompt inputs.