CVE-2026-54760 Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Attackers can bypass SQL injection protections in Langroid's SQLChatAgent to read arbitrary server files via crafted PostgreSQL queries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54760?
CVE-2026-54760 is a critical SQL injection vulnerability in langroid, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS`) with a `sqlglot` SELECT-only statement allowlist. The blocklist entries that target callable functions require the function name to be immediately followed by `\s*\(`. PostgreSQL accepts the same call with the name separated from `(` by a quoted identifier, an inline comment, or schema qualification. These forms evade the regex, still parse as `SELECT`, and execute the same PostgreSQL function. This restores the `pg_read_file` server-side file-read primitive that the prior CVE-2026-25879 / GHSA-pmch-g965-grmr fix was meant to block: the parent advisory fixed a missing `pg_read_file` blocklist entry, while this report shows that the added regex is bypassable. Version 0.65.1 fixes the issue.
Which versions are affected by CVE-2026-54760?
3 open source packages ship an affected version, including langroid.
| Package | Affected | Fixed in |
|---|---|---|
langroid PyPI | All versions | 0.65.1 |
langroid PyPI | All versions | 0.65.1 |
langroid PyPI | All versions | 0.65.1 |
How do I fix CVE-2026-54760?
Upgrade langroid to 0.65.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-54760 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54760 exists.
Sources
Also known as GHSA-6xc5-4r68-67fc, PYSEC-2026-2577.