CVE-2026-50180 Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
Attackers can read arbitrary files from the PostgreSQL host by bypassing SQL blocklists in Langroid's SQLChatAgent via prompt injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50180?
CVE-2026-50180 is a high-severity path traversal vulnerability in langroid, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH '<file>' AS x` (DATABASE keyword omitted) unblocked. An attacker able to shape the LLM's generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent's strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=['SELECT']`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`. Version 0.64.0 contains a patch for the issue.
Which versions are affected by CVE-2026-50180?
3 open source packages ship an affected version, including langroid.
| Package | Affected | Fixed in |
|---|---|---|
langroid PyPI | All versions | 0.64.0 |
langroid PyPI | All versions | 0.64.0 |
langroid PyPI | All versions | 0.64.0 |
How do I fix CVE-2026-50180?
Upgrade langroid to 0.64.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-50180 being exploited?
There is no known exploitation of CVE-2026-50180 in the wild and no public exploit code.
Sources
Also known as GHSA-pmch-g965-grmr, PYSEC-2026-2580.