CVE-2026-75062

9.2 criticalEPSS 0.4%

Critical (9.2). EPSS 0.4% chance of exploitation in the next 30 days.

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.

Severity

CVSS 4.0

9.2 critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWEs: CWE-95, CWE-1188
Published: 2026-08-26
Modified: 2026-08-31
Record from: the NVD, synced 2026-10-19

References

https://github.com/google/langfun
https://github.com/google/langfun/issues/725
https://github.com/google/langfun/issues/725

Check your stack JSON