What is GHSA-8x83-862f-c85r?

GHSA-8x83-862f-c85r is a security advisory published by GitHub Security Advisories with Critical severity. Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the...

Which CVE IDs does GHSA-8x83-862f-c85r cover?

GHSA-8x83-862f-c85r covers the following CVE IDs: CVE-2026-75062. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-8x83-862f-c85rCritical

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the...

Vendor

GitHub Security Advisories

Published

August 26, 2026

Last Modified

August 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-75062 →

📋 Description

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-75062
https://github.com/google/langfun/issues/725
https://github.com/google/langfun
https://github.com/advisories/GHSA-8x83-862f-c85r