SQL Injection Vulnerability in Langroid Framework Affects File Disclosure
CVE-2026-50180

8.7HIGH

Key Information:

Vendor

Langroid

Status
Langroid
Vendor
CVE Published:
9 July 2026

What is CVE-2026-50180?

The Langroid framework, used for developing large-language-model-powered applications, suffers from a security flaw in the 'SQLChatAgent' component. Before version 0.64.0, the defense-in-depth mechanism _validate_query failed to properly block several high-risk SQL functions from PostgreSQL, SQL Server, and SQLite, including filesystem-disclosure commands. This oversight allows unauthorized access to files on the PostgreSQL host via crafted SQL queries. Attackers can exploit this vulnerability to bypass restrictions set in the agent's configuration and execute SELECT statements that access sensitive data. Version 0.64.0 has been updated to remediate this issue.

Affected Version(s)

langroid < 0.64.0

References

https://github.com/langroid/langroid/security/advisories/...
x_refsource_CONFIRM
https://github.com/langroid/langroid/commit/00b7dd7b79c5d...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.