GoogleCVE-2026-75062

Google langfun: insecure default

Critical9.2CVE-2026-75062 · Published Aug 26, 2026 · updated Aug 31, 2026

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.

Google advisory

Affected versions

Package	Affected	Fixed in
langfun Product	>= 0.0.1, < 0.1.2	0.1.2

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-95, CWE-1188

More Google advisories

All Google

Date	Advisory	Severity	Fixed in
Aug 25	Improper control of a resource through its lifetime in Workers in Google Chrome... Low3.1Aug 25 CVE-2026-79289152.0.7977.65	Low3.1	152.0.7977.65
Aug 25	Google Chrome: use after free Critical9.6Aug 25 CVE-2026-79290152.0.7977.65	Critical9.6	152.0.7977.65
Aug 25	Google Chrome: information disclosure Medium6.5Aug 25 CVE-2026-79291152.0.7977.65	Medium6.5	152.0.7977.65
Aug 25	Google Chrome: integer overflow High8.3Aug 25 CVE-2026-79292152.0.7977.65	High8.3	152.0.7977.65
Aug 25	Google Chrome: information disclosure Medium6.5Aug 25 CVE-2026-79293152.0.7977.65	Medium6.5	152.0.7977.65
Aug 25	Google Chrome: use after free Critical9.6Aug 25 CVE-2026-79275152.0.7977.65	Critical9.6	152.0.7977.65

Affected versions

More Google advisories

Critical advisories by email