GHSA-pmch-g965-grmr: Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Summary

The SQLChatAgent in langroid, versions up to and including 0.63.0, uses a regex blocklist (_DANGEROUS_SQL_PATTERNS in sql_chat_agent.py) that omits PostgreSQL's pg_read_file, pg_stat_file, pg_ls_logdir, pg_ls_waldir and related functions, plus SQL Server OPENDATASOURCE and SQLite ATTACH without the DATABASE keyword. Because these payloads are ordinary SELECT statements, they pass the statement-type allowlist and reach the live engine, letting an attacker who can shape the LLM's generated SQL read arbitrary files from the PostgreSQL host, even under the default configuration.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langroidPyPILLM dependency since 2023-07-14

Related items

• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database
• HighCVE-2026-106119: LangChain MongoDBChatMessageHistory query injection via session identifierSame vendor · NVD/CVE Database
• LowGHSA-5x6v-p487-7qh2: LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesSame vendor · GitHub Advisory Database
• HighGHSA-fvww-7h3r-vfhp: LangGraph SDK custom auth silently ignores actions= on resource decoratorsSame vendor · GitHub Advisory Database
• HighCVE-2026-72848: SitemapLoader nested sitemap entries bypass restrict_to_same_domainSame vendor · NVD/CVE Database