Executive brief
Langroid is a framework used to build applications powered by large language models (LLMs). A security flaw in its SQL database agent allows attackers to bypass safety filters and execute restricted database functions. This could allow an attacker to read sensitive files from the server's filesystem or access unauthorized data, potentially leading to a full system compromise depending on database permissions.
Technical details
The `SQLChatAgent` in Langroid uses a regex-based blocklist (`_DANGEROUS_SQL_PATTERNS`) to prevent the execution of sensitive PostgreSQL functions. However, the regex specifically looks for function names immediately followed by a parenthesis. Attackers can bypass this check by using quoted identifiers, inline comments, or schema qualifications (e.g., `pg_catalog."pg_read_file"()`), which PostgreSQL accepts but the regex fails to match. Since the `sqlglot` validator only enforces statement types (SELECT) and does not inspect the AST for blocked functions, these obfuscated queries are executed. This allows for server-side file reads if the database role has sufficient privileges. The issue is fixed in version 0.65.1 by moving away from regex-based matching to AST-based function validation.
Affected products
- langroid langroid < 0.65.1
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD
- 2026-07-10: patched: Fixed in version 0.65.1