Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, TableChatAgent
uses pandas eval()
. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to TableChatAgent
by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.