CVE-2023-39631: TiTiler Remote Code Execution via numexpr Expression Evaluation

numexpr is a Python library for fast numerical expression evaluation. Before 2.8.5 its evaluate function passed expressions to eval() with no filtering. TiTiler, a dynamic tile server for geospatial data, exposes an expression parameter that feeds numexpr.

An unauthenticated attacker sends a crafted expression to a TiTiler endpoint and runs arbitrary Python on the server. The same flaw was reported against LangChain's math chain, and the CVE record names LangChain 0.0.245. numexpr 2.8.5 adds input validation that blocks the dangerous characters; LangChain 0.0.308 picks up the fix.