CVE-2026-25879
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Langroid SQLChatAgent before version 0.63.0 executes SQL generated by an LLM, which is influenceable by prompt injection. An attacker can coerce execution of dangerous operations like COPY ... FROM PROGRAM, leading to remote code execution on the database host.
Risk Assessment
The risk for the organization includes full compromise of the database host, potentially leading to data exfiltration, modification, or corruption, and further attacks on the infrastructure.
Recommendation
Immediately update Langroid to version 0.63.0 or later. If full functionality is required, configure SQLChatAgent with allow_dangerous_operations=True only in a trusted environment.
Original NVD description (English source)
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.63.0, SQLChatAgent executes SQL produced by an LLM, which is influenceable by prompt injection. When configured with a database role that has privileges enabling code execution or filesystem access (e.g., PostgreSQL pg_execute_server_program, MySQL FILE, MSSQL xp_cmdshell), an attacker who can shape the agent's input — including indirectly via data returned to the LLM — can coerce execution of dialect-specific primitives such as `COPY ... FROM PROGRAM`, achieving RCE on the database host. Fixed in v0.63.0 by defaulting SQLChatAgent to a SELECT-only sqlglot-parsed statement allowlist with a dialect-aware dangerous-pattern blocklist; allow_dangerous_operations=True restores the previous unrestricted behavior for trusted deployments.