External risk intelligence

Google Langfun Eval Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-75062

This vulnerability exists in a Python library used for language model interaction. While it can be reachable if an application exposes a prompt interface to the internet, the library itself is typically integrated into internal backend code rather than serving as a public-facing network gateway or edge service by default.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a Python library used for language model interactions could allow attackers to execute arbitrary code on affected systems. This occurs when malicious inputs are processed by the system, leading to the evaluation of un-sandboxed Python expressions.

Code execution vulnerability in a Python library.
Important for assessing impact on backend applications.
Confirm relevance and exposure to internal systems.

Attack Path

How an attacker could exploit the issue

An attacker could execute arbitrary Python code by sending specially crafted inputs to an application that uses a vulnerable version of the Google langfun Python protocol. This would involve tricking the application into evaluating malicious Python expressions through the `lf.query` feature, bypassing any intended security measures and running code on the host system.

Remote, unauthenticated access required.
Crafted prompts trigger code execution.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary Python code within the context of an application using the `lf.query` protocol. This could occur when crafted prompt inputs cause the application to evaluate untrusted Python expressions without proper sandboxing, potentially impacting the host application's services and data.

Arbitrary Python code execution.
Crafted prompts may trigger code evaluation.
Host application services and data affected.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Google langfun Python protocol necessitates immediate attention from application owners and platform teams responsible for its integration. The first practical step is to identify all instances where langfun is deployed, determine their exposure and business criticality, and then assign ownership for remediation planning.

Confirm application and platform team ownership.
Verify reachable and critical deployments.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google langfun?

Google langfun is a Python library designed to simplify interaction with large language models. Developers use it to build systems where language models perform tasks by querying data or triggering logic. Because it manages the connection between a user's prompt and the model's output, it acts as a functional layer within backend applications, enabling more complex, programmatic language model behaviors.

What does CVE-2026-75062 mean by Eval Injection?

This vulnerability involves a weakness known as Improper Neutralization of Directives (CWE-95). In plain terms, the library takes instructions from a language model and runs them as Python code without checking if they are safe. If an attacker crafts a specific input that tricks the language model into generating malicious code, the library executes that code directly on the host system.

How do attackers trigger this code execution?

An attacker triggers this by sending a crafted prompt to an application using the vulnerable langfun protocol. The application then processes this input through the model, which inadvertently creates a malicious Python expression that the library evaluates. Note that simply using the library for standard, non-dynamic prompts or having static, hard-coded inputs does not trigger this vulnerability.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes this as a possible risk. While the library is generally used in internal backend code rather than as a public-facing gateway, your system is at higher risk if you have an application that exposes a prompt-processing interface directly to the internet. You should determine if any user-facing features allow untrusted input to reach the langfun processing logic.

What is the first step for fixing this?

Your first step is to perform an inventory of all applications within your environment that incorporate the Google langfun library. Once identified, map these instances to understand which are reachable from the internet or handle sensitive data. After establishing this, coordinate with your engineering and platform teams to prioritize updates for those critical deployments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.