CVE-2026-75062

Executive Summary

CVE-2026-75062 is an Eval Injection vulnerability (CWE-95) in the lf.query Python protocol of Google langfun, a library designed to enable language-model-based function calling. Affected versions prior to 0.1.2 allow remote, unauthenticated attackers to achieve arbitrary Python code execution in the context of the host application by crafting prompt inputs that cause the underlying model to generate executable Python expressions that are evaluated without a sandbox. The vulnerability is currently unpatched in unsupported versions, and no public PoC or exploit code has been observed in the wild at the time of reporting.

Technical Analysis

The vulnerability resides in the default lf.query protocol within Google langfun. Specifically, the NVD description indicates that the protocol fails to properly neutralize directives in dynamically evaluated code, classifying this as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code).

The attack surface is the language-model input pipeline: an attacker submits crafted prompt text to an application using langfun's lf.query function. When this prompt is processed by the language model, the model's output is assumed to be a valid Python expression. This expression is then passed to Python's evaluation mechanism (e.g., eval() or a similar dynamic execution path) without sandboxing restrictions. The lack of validation on the generated Python code means that if the model can be induced to output arbitrary expressions — through prompt injection, direct user control, or model hallucination — the expression is executed with the full privileges of the host process.

No specific function names, API endpoints, or parameter names beyond lf.query are provided in the NVD description. The vulnerability class is well-understood: it represents a classic failure to distinguish between code and data in a dynamically evaluated context. Because langfun is used to connect language models with programmatic execution, any application that surfaces even partially user-controlled prompts to the model and evaluates the model's output as Python code is vulnerable.

The attack does not require authentication, implying that the vulnerable component may be exposed through public-facing services such as web APIs, chatbots, or automation endpoints that accept prompt input.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker identifies a public-facing service or application that integrates Google langfun (e.g., a chatbot, API endpoint, or automated tool that accepts natural-language queries and returns computed results). The attacker may fingerprint langfun by sending test prompts and observing whether the application returns results consistent with Python-expression evaluation.

Step 2 — Flaw Trigger: The attacker crafts a prompt designed to cause the underlying language model to output a malicious Python expression. Given the uncontrolled prompt-to-execution pipeline, the attacker can use direct instruction (prompt injection) or indirect techniques (jailbroken model instructions) to steer the model's output. The resulting model-generated code is passed to the evaluation context without neutralization.

Step 3 — Payload/Execution Method: At the vulnerability-class level, the payload is a Python expression or statement that performs a harmful action. Examples include: reading sensitive files, opening reverse shells, exfiltrating environment variables (which often contain API keys and credentials), or writing malicious files to disk. The specific expression is limited only by the model's ability to generate Python code and the host's Python environment, meaning a fully functional RCE payload can be delivered.

Step 4 — Post-Exploitation Impact: Successful exploitation yields arbitrary code execution in the context of the host application. Depending on the deployment, this may lead to: full server compromise, lateral movement within the internal network, data exfiltration, denial-of-service, or persistence mechanisms. Because the attacker is unauthenticated, the barrier to initial access is low once a vulnerable langfun instance is discovered.

Note: No public PoC exists at the time of writing. The attack chain above is inferred from the vulnerability class (CWE-95) and the NVD description. Specific code patterns or function names beyond lf.query are not disclosed and should not be assumed.

Impact Assessment

The business impact of CVE-2026-75062 is severe due to the combination of remote, unauthenticated access and arbitrary code execution. The CVSS score is listed as N/A, providing no official severity rating; however, based on the vulnerability characteristics — remote exploitation, no authentication requirement, high integrity and confidentiality impact — the de facto severity is likely Critical if it were scored.

Affected Systems: Any application using Google langfun versions prior to 0.1.2 that exposes the model-query protocol to untrusted input. This includes public chatbots, internal tooling APIs, and automated reasoning pipelines.

Blast Radius: Code execution in the host process means the attacker gains the privileges of the service account. In containerized or cloud environments, this may extend to cloud metadata services (e.g., IAM credentials) if the host has network access. The blast radius also includes supply-chain concerns: any downstream application that integrates a vulnerable langfun version inherits the risk.

Data Impact: The attacker can read, modify, or destroy data accessible to the host process, including customer records, credentials, and source code.

Detection Guidance

Sigma Rule

title: Google langfun Eval Injection - Python Expression Execution
id: 8f6f2c1e-9a4b-4e3c-b7d1-5a9e6f1c2b3d
status: experimental
description: Detects logs indicating Python eval execution associated with langfun lf.query protocol, possibly indicating CVE-2026-75062 exploitation.
logsource:
    category: application
    product: python
    definition: 'Requires logging of eval() calls or Python exceptions in the application log.'
detection:
    selection_eval:
        - Message|contains|all:
            - 'eval('
            - 'langfun'
        - Message|contains|all:
            - 'exec('
            - 'lf.query'
    selection_exception:
        Message|contains:
            - 'SyntaxError'
            - 'NameError'
            - 'TypeError'
        EventID: 'error'
    condition: selection_eval or selection_exception
level: high
falsepositives:
    - Legitimate use of dynamic evaluation in development environments
    - Benign Python errors in langfun processing
tags:
    - attack.t1190
    - attack.t1059.006
    - cve.2026-75062

YARA Rule

rule CVE_2026_75062_Langfun_Eval_Injection {
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects Python code patterns indicative of eval injection in langfun lf.query outputs"
        reference = "CVE-2026-75062"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "lf.query" ascii wide
        $s2 = "eval(" ascii wide
        $s3 = "exec(" ascii wide
        $s4 = "os.system" ascii wide
        $s5 = "subprocess" ascii wide
        $s6 = "socket" ascii wide
        $s7 = "base64" ascii wide
        $s8 = "pickle" ascii wide
    condition:
        $s1 and (
            $s2 or $s3 or $s4 or $s5 or $s6 or $s7 or $s8
        ) and filesize < 2MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75062 - Google langfun Eval Injection Attempt"; flow:established,to_server; content:"langfun"; http_uri; content:"query"; http_uri; pcre:"/(eval|exec|os\.system|subprocess|__import__)/iU"; sid:75062001; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-75062;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.action == "exec" and process.name == "python" and
     process.args : ("*langfun*", "*lf.query*")]
  [file where event.action in ("read", "write") and
     file.path : ("/etc/passwd", "/root/.ssh*", "/var/run/secrets/*", "/app/.env*")]

Note: This EQL rule detects a common post-exploitation pattern (file access shortly after a Python process execution related to langfun). Adjust file paths to match your environment.

Splunk SPL Query

index=python sourcetype=python_logs OR index=main sourcetype=syslog
| search "langfun" OR "lf.query"
| regex _raw="(eval\(|exec\(|os\.system|subprocess\.|__import__|base64\.b64decode|socket\.)"
| table _time, host, source, _raw
| sort -_time

Wazuh OSSEC Rule

<group name="langfun,">

  <rule id="100750" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">\.(eval|exec)\(.*langfun</field>
    <description>CVE-2026-75062: Potential eval injection via langfun lf.query detected</description>
    <group>cve-2026-75062,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100751" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">os\.system|subprocess|socket\.</field>
    <field name="message">langfun</field>
    <description>CVE-2026-75062: Post-exploitation indicators following langfun usage</description>
    <group>cve-2026-75062,</group>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED for affected versions. No patch evidence from any tracked source.

1. Immediate Mitigations (do now):

   • Upgrade to langfun 0.1.2 or later — the NVD description indicates this version addresses the flaw.
   • If immediate upgrade is not possible, do not expose lf.query endpoints to untrusted input. Restrict access to trusted internal users only.
   • Disable dynamic evaluation in your langfun configuration if a feature flag or configuration option exists to control whether model outputs are evaluated as Python expressions.
   • Apply strict input validation and prompt sanitization at the application layer to reduce the risk of prompt injection.

2. Patch/Upgrade Steps:

   • Confirm current langfun version via pip show langfun or the equivalent package manager.
   • Upgrade using: pip install --upgrade langfun>=0.1.2
   • Verify the upgrade in a staging environment before production rollout.
   • Monitor vendor channels (GitHub releases, PyPI) for subsequent security advisories.

3. Long-Term Hardening:

   • Sandbox all dynamic code evaluation — never evaluate model-generated code in the host Python process. Isolate execution in containers, subprocesses with restricted privileges, or with Python sandboxing libraries.
   • Review application architecture for any other instances where model output is interpreted as code.
   • Enable comprehensive logging of prompt inputs and model outputs for forensic purposes.
   • Subscribe to Google's security advisories for langfun and related LLM tooling.
   • Conduct a security audit of any public-facing applications that integrate large-language-model function-calling capabilities to identify other eval-based injection vectors.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75062
2. MITRE CWE-95: https://cwe.mitre.org/data/definitions/95.html (Improper Neutralization of Directives in Dynamically Evaluated Code)
3. Google langfun (official repository): https://github.com/google/langfun
4. PyPI — langfun package: https://pypi.org/project/langfun/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75062 not currently listed)

Exploit-in-the-wild status: No public PoC, Nuclei template, or exploit code has been identified. No known threat-actor campaigns are associated with this CVE at the time of writing. Organizations are advised to monitor vendor channels and threat intel feeds for updates as this vulnerability matures.