GoogleCVE-2026-75062

Google langfun: insecure default

CVE-2026-75062 · Published Aug 26, 2026 · updated Aug 31, 2026

Critical9.2

Fix: upgrade to 0.1.2 or later

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.

Affected versions

Package	Affected	Fixed in
langfun Product	>= 0.0.1, < 0.1.2	0.1.2

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-95, CWE-1188

More Google advisories

All Google

Low 3.1Aug 25

Improper control of a resource through its lifetime in Workers in Google Chrome...CVE-2026-79289fixed in 152.0.7977.65 Critical 9.6Aug 25

Google Chrome: use after freeCVE-2026-79290fixed in 152.0.7977.65 Medium 6.5Aug 25

Google Chrome: information disclosureCVE-2026-79291fixed in 152.0.7977.65 High 8.3Aug 25

Google Chrome: integer overflowCVE-2026-79292fixed in 152.0.7977.65 Medium 6.5Aug 25

Google Chrome: information disclosureCVE-2026-79293fixed in 152.0.7977.65 Critical 9.6Aug 25

Google Chrome: use after freeCVE-2026-79275fixed in 152.0.7977.65