The vulnerability (CVE-2026-25481) affects langroid versions prior to 0.59.32. It involves the TableChatAgent's use of the pandas_eval tool to evaluate expressions. Although a WAF was introduced to prevent code injection (related to CVE-2025-46724), it can be bypassed because the _literal_ok() function returns False instead of raising an UnsafeCommandError on invalid input. This, combined with unrestricted access to dangerous dunder attributes such as __init__, __globals__, and __builtins__, allows attackers to chain whitelisted DataFrame methods to leak the eval builtin function and execute arbitrary code remotely. The exploit uses a crafted DataFrame column name to execute shell commands on the server. The vulnerability leads to remote code execution via user-controlled input in the pandas_eval tool within TableChatAgent.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shell commands on the server running langroid's TableChatAgent. This results in full remote code execution (RCE), compromising the confidentiality, integrity, and availability of the affected system. The vulnerability bypasses existing WAF protections and leverages Python internals to execute malicious code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of langroid (<=0.59.31) in untrusted environments. Restrict access to the pandas_eval tool and disable or limit user-controlled expression evaluation. Monitor vendor channels for updates or patches addressing this vulnerability.