CyberRota Analysis
AI-GeneratedThe default lf.query Python protocol in Google langfun versions prior to 0.1.2 is vulnerable to Eval Injection, allowing remote unauthenticated attackers to execute arbitrary Python code within the host application. This critical vulnerability poses a significant risk as it can lead to unauthorized access and manipulation of the system. Organizations using affected versions should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.