https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:39:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335762 EUVD-2026-335762 https://cve.radiocsirt.org/vuln/euvd-2026-335762 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50180 <p>Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH &#39;&lt;file&gt;&#39; AS x` (DATABASE keyword omitted) unblocked. An attacker able to shape the LLM&#39;s generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent&#39;s strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=[&#39;SELECT&#39;]`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`. Version 0.64.0 contains a patch for the issue.</p> <p>Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH &#39;&lt;file&gt;&#39; AS x` (DATABASE keyword omitted) unblocked. An attacker able to shape the LLM&#39;s generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent&#39;s strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=[&#39;SELECT&#39;]`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`. Version 0.64.0 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50180 https://cve.radiocsirt.org/vuln/ghsa-pmch-g965-grmr <p><strong>Affected:</strong> PyPI: langroid</p> <p>### Summary</p> <p>`SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH &#39;&lt;file&gt;&#39; AS x` (DATABASE keyword omitted) unblocked.</p> <p>An attacker able to shape the LLM&#39;s generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent&#39;s strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=[&#39;SELECT&#39;]`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`.</p> <p>### Affected versions</p> <p>`langroid` `&lt;= 0.63.0` (latest at the time of this report; PyPI release 2026-05-27). The vulnerable code path is `langroid/agent/special/sql/sql_chat_agent.py::_validate_query`, which consults the module-level `_DANGEROUS_SQL_PATTERNS` literal at `sql_chat_agent.py:113-141`.</p> <p>### Privilege required</p> <p>Any caller able to influence the LLM-generated `RunQueryTool.query`…</p> <p><strong>Affected:</strong> PyPI: langroid</p> <p>### Summary</p> <p>`SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH &#39;&lt;file&gt;&#39; AS x` (DATABASE keyword omitted) unblocked.</p> <p>An attacker able to shape the LLM&#39;s generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent&#39;s strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=[&#39;SELECT&#39;]`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`.</p> <p>### Affected versions</p> <p>`langroid` `&lt;= 0.63.0` (latest at the time of this report; PyPI release 2026-05-27). The vulnerable code path is `langroid/agent/special/sql/sql_chat_agent.py::_validate_query`, which consults the module-level `_DANGEROUS_SQL_PATTERNS` literal at `sql_chat_agent.py:113-141`.</p> <p>### Privilege required</p> <p>Any caller able to influence the LLM-generated `RunQueryTool.query`…</p> https://cve.radiocsirt.org/vuln/ghsa-pmch-g965-grmr https://cve.radiocsirt.org/vuln/pysec-2026-2580 <p><strong>Affected:</strong> PyPI: langroid</p> <p>### Summary</p> <p>`SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH &#39;&lt;file&gt;&#39; AS x` (DATABASE keyword omitted) unblocked.</p> <p>An attacker able to shape the LLM&#39;s generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent&#39;s strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=[&#39;SELECT&#39;]`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`.</p> <p>### Affected versions</p> <p>`langroid` `&lt;= 0.63.0` (latest at the time of this report; PyPI release 2026-05-27). The vulnerable code path is `langroid/agent/special/sql/sql_chat_agent.py::_validate_query`, which consults the module-level `_DANGEROUS_SQL_PATTERNS` literal at `sql_chat_agent.py:113-141`.</p> <p>### Privilege required</p> <p>Any caller able to influence the LLM-generated `RunQueryTool.query`…</p> <p><strong>Affected:</strong> PyPI: langroid</p> <p>### Summary</p> <p>`SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH &#39;&lt;file&gt;&#39; AS x` (DATABASE keyword omitted) unblocked.</p> <p>An attacker able to shape the LLM&#39;s generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent&#39;s strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=[&#39;SELECT&#39;]`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`.</p> <p>### Affected versions</p> <p>`langroid` `&lt;= 0.63.0` (latest at the time of this report; PyPI release 2026-05-27). The vulnerable code path is `langroid/agent/special/sql/sql_chat_agent.py::_validate_query`, which consults the module-level `_DANGEROUS_SQL_PATTERNS` literal at `sql_chat_agent.py:113-141`.</p> <p>### Privilege required</p> <p>Any caller able to influence the LLM-generated `RunQueryTool.query`…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2580