CVE-2026-54760: Langroid SQLChatAgent regex bypass in SQL injection mitigation

CVE-2026-54760 · Severity: critical · CVSS 4 · Published 2026-07-10

Langroid is a framework used to build applications powered by large language models (LLMs). A security flaw in its SQL database agent allows attackers to bypass safety filters and execute restricted database functions. This could allow an attacker to read sensitive files from the server's filesystem or access unauthorized data, potentially leading to a full system compromise depending on database permissions.

Technologies: langroid (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54760 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54760 being exploited in the wild.
How severe is CVE-2026-54760?
Critical severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
langroid (PyPI) <= 0.65.0, ECOSYSTEM:introduced=0,fixed=0.65.1.
Is there a fix for CVE-2026-54760?
Yes. langroid (PyPI): upgrade to 0.65.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54760 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54760?
Check whether you run langroid (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langroid (PyPI): upgrade to 0.65.1 or later
    pip install "langroid>=0.65.1"

Technical details

The `SQLChatAgent` in Langroid uses a regex-based blocklist (`_DANGEROUS_SQL_PATTERNS`) to prevent the execution of sensitive PostgreSQL functions. However, the regex specifically looks for function names immediately followed by a parenthesis. Attackers can bypass this check by using quoted identifiers, inline comments, or schema qualifications (e.g., `pg_catalog."pg_read_file"()`), which PostgreSQL accepts but the regex fails to match. Since the `sqlglot` validator only enforces statement types (SELECT) and does not inspect the AST for blocked functions, these obfuscated queries are executed. This allows for server-side file reads if the database role has sufficient privileges. The issue is fixed in version 0.65.1 by moving away from regex-based matching to AST-based function validation.

Affected products

  • langroid langroid < 0.65.1

Identifiers

  • CVE-2026-54760
  • GHSA-6xc5-4r68-67fc
  • PYSEC-2026-2577

Timeline

  • 2026-06-09: advisory: GitHub Security Advisory published
  • 2026-07-10: disclosed: CVE published to NVD
  • 2026-07-10: patched: Fixed in version 0.65.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.