{"cve":"CVE-2026-50180","nvd":{"published":"2026-07-10T00:16:33.197","modified":"2026-07-10T21:16:54.860","status":"Deferred","description":"Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH '<file>' AS x` (DATABASE keyword omitted) unblocked. An attacker able to shape the LLM's generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent's strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=['SELECT']`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`. Version 0.64.0 contains a patch for the issue.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":null,"cwes":["CWE-22","CWE-89"],"references":["https://github.com/langroid/langroid/commit/00b7dd7b79c5d03c94be284cf3459d98195ebfba","https://github.com/langroid/langroid/security/advisories/GHSA-pmch-g965-grmr"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:44:02.134301115+00:00"},"epss":{"cve":"CVE-2026-50180","score":0.00686,"percentile":0.52677,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pmch-g965-grmr","url":"https://osv.dev/vulnerability/GHSA-pmch-g965-grmr","summary":"Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read","modified":"2026-07-13T16:43:13.962169214Z","packages":[{"ecosystem":"PyPI","name":"langroid","purl":"pkg:pypi/langroid","ranges":["<0.64.0"],"fixed":["0.64.0"]}]},{"id":"PYSEC-2026-2580","url":"https://osv.dev/vulnerability/PYSEC-2026-2580","summary":"Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read","modified":"2026-07-13T16:31:49.875978863Z","packages":[{"ecosystem":"PyPI","name":"langroid","purl":"pkg:pypi/langroid","ranges":["<0.64.0"],"fixed":["0.64.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}