CVE-2026-50180

Name of the Vulnerable Software and Affected Versions langroid versions prior to 0.64.0

Description The SQLChatAgent in langroid implements a defense-in-depth layer via the validate query method, which uses a regex blocklist DANGEROUS SQL PATTERNS to prevent the execution of dangerous SQL primitives. However, this blocklist is incomplete and fails to include several critical functions. In PostgreSQL, it misses the filesystem-disclosure family, including pg read file(), pg stat file(), pg ls logdir(), pg ls waldir(), and pg current logfile(). Additionally, it does not block the OPENDATASOURCE function in SQL Server or the ATTACH '<file>' AS x syntax in SQLite where the DATABASE keyword is omitted.

An attacker who can influence the SQL generated by the LLM—either through direct prompt input or prompt-injection in ingested data—can bypass these filters. Since the missing functions are syntactically SELECT statements, they pass through the agent's default allowlist (allowed statement types=['SELECT']) and the regex blocklist, eventually reaching the SQLAlchemy engine via the run query() function. This can lead to arbitrary file reads from the PostgreSQL host, filesystem reconnaissance, or unauthorized remote connections and file access in MSSQL and SQLite environments.

Recommendations Update langroid to version 0.64.0 or later. As a temporary mitigation, restrict the use of the SQLChatAgent.run query() function or implement stricter input validation on prompts that influence SQL generation.