Executive brief
Langroid is a software framework used to build applications powered by large language models (LLMs). A vulnerability in its SQLChatAgent component allows attackers to execute unauthorized commands on the underlying database server by tricking the AI into generating malicious SQL code. This could lead to full system takeover, theft of sensitive data, or complete deletion of database contents.
Technical details
The SQLChatAgent in Langroid versions prior to 0.63.0 executes SQL queries generated by an LLM without sufficient validation. By using prompt injection techniques, an attacker can influence the LLM to produce dialect-specific administrative commands (such as PostgreSQL's 'COPY FROM PROGRAM' or MSSQL's 'xp_cmdshell'). If the database connection is configured with high privileges, this results in remote code execution (RCE) on the database host. The vulnerability is triggered via network-reachable inputs that are processed by the agent's task loop. Version 0.63.0 mitigates this by implementing a SELECT-only allowlist and a dangerous-pattern blocklist using the sqlglot parser.
Affected products
- Langroid Langroid < 0.63.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: CVE published to NVD
- 2026-06-01: patched: Fixed in version 0.63.0