CVE-2026-54760
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
In Langroid framework prior to version 0.65.1, a SQL injection vulnerability was found in the `SQLChatAgent` component. Despite default dangerous operations being disabled, the protection mechanism using a regex blocklist and SELECT allowlist can be bypassed with crafted PostgreSQL queries, enabling server file reads.
Risk Assessment
An attacker can bypass security controls and execute PostgreSQL functions like `pg_read_file`, leading to unauthorized file reads on the database server. This could result in exposure of sensitive data, including configuration and user information.
Recommendation
Immediately update Langroid to version 0.65.1 or later. Additionally, implement extra security layers such as query validation on the database server side.
Original NVD description (English source)
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS`) with a `sqlglot` SELECT-only statement allowlist. The blocklist entries that target callable functions require the function name to be immediately followed by `\s*\(`. PostgreSQL accepts the same call with the name separated from `(` by a quoted identifier, an inline comment, or schema qualification. These forms evade the regex, still parse as `SELECT`, and execute the same PostgreSQL function. This restores the `pg_read_file` server-side file-read primitive that the prior CVE-2026-25879 / GHSA-pmch-g965-grmr fix was meant to block: the parent advisory fixed a missing `pg_read_file` blocklist entry, while this report shows that the added regex is bypassable. Version 0.65.1 fixes the issue.