Google langfun default query protocol allows unsandboxed eval injection RCE

The default lf.query Python protocol in Google's langfun library (versions before 0.1.2) evaluates model-generated Python expressions without a sandbox. A remote unauthenticated attacker can craft prompt inputs that cause the LLM to generate executable Python expressions, which are then evaluated directly in the host application's context.

langfun is used to structure LLM outputs into executable protocols; unsandboxed eval of model-generated code turns any prompt-injectable input surface into a remote code execution vector against the host application — a direct case of prompt injection reaching arbitrary code execution.

Crafted prompt input causes the LLM to emit a malicious Python expression that langfun evaluates unsandboxed via lf.query

Google langfun < 0.1.2

Upgrade to langfun >= 0.1.2; avoid unsandboxed eval of model-generated code in production