GHSA-mxfr-6hcw-j9rq: Langroid has Prompt to SQL Injection, Leading to RCE

Summary

Langroid versions before 0.63.0 let SQLChatAgent run SQL that an LLM generates from input it can be steered to take, including data returned to the model. When the configured database role holds privileges such as PostgreSQL pg_execute_server_program, MySQL FILE, or MSSQL xp_cmdshell, an attacker can use dialect-specific primitives like COPY ... FROM PROGRAM to execute commands on the database host. The advisory's proof of concept shows execution of the id command through this path.

Mitigation

Fixed in vX.Y by defaulting SQLChatAgent to a SELECT-only sqlglot-parsed statement allowlist with a dialect-aware dangerous-pattern blocklist. Setting allow_dangerous_operations=True restores the previous unrestricted behavior, intended only for trusted deployments.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langroidPyPILLM dependency since 2023-07-14

Related items

• HighCVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted toolsSimilar attack · NVD/CVE Database
• LowAgents at the Edge: Extending AI Security Governance to Physical AI with DefenseClawSimilar attack · Cisco AI Blog
• InfoWhat You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply ChainsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPolicy-Verified Self-Training: Learning Agent Compliance from Verifiable Policy RewardsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)