CVE-2026-54760: Langroid SQL Injection Vulnerability

CVE-2026-54760 Overview

CVE-2026-54760 is a SQL injection filter bypass in Langroid, a framework for building large-language-model-powered applications. The vulnerability affects the SQLChatAgent component in versions prior to 0.65.1. The mitigation combines a regex-based blocklist (_DANGEROUS_SQL_PATTERNS) with a sqlglot SELECT-only allowlist. Attackers can bypass the regex by inserting a quoted identifier, inline comment, or schema qualification between a dangerous function name and its opening parenthesis. This restores the pg_read_file server-side file-read primitive that the earlier CVE-2026-25879 fix aimed to block. The advisory tracks this issue under [CWE-22] path traversal.

Critical Impact
Attackers can read arbitrary server-side files through PostgreSQL when allow_dangerous_operations=False is set, defeating the intended security control.

Affected Products

Langroid framework versions prior to 0.65.1
Deployments using SQLChatAgent with PostgreSQL backends
Applications relying on the default allow_dangerous_operations=False setting

Discovery Timeline

2026-07-10 - CVE-2026-54760 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-54760

Vulnerability Analysis

The SQLChatAgent in Langroid enforces safe SQL execution through two layers. The first layer is a raw-text regex blocklist named _DANGEROUS_SQL_PATTERNS. The second layer is a sqlglot parser allowlist that permits only SELECT statements. The regex entries targeting callable functions require the function name to be immediately followed by \s*\(. This assumption does not hold in PostgreSQL, which accepts function calls where the name is separated from ( by quoted identifiers, inline comments, or schema qualification. Payloads using these separators evade the blocklist while still parsing as valid SELECT statements. The parent advisory CVE-2026-25879 added pg_read_file to the blocklist, but the regex bypass reintroduces the file-read primitive.

Root Cause

The root cause is incomplete input validation in the regex patterns used to detect dangerous PostgreSQL functions. The patterns anchor detection on immediate whitespace and an opening parenthesis. They fail to account for the range of syntactic separators that PostgreSQL tolerates between a function identifier and its argument list. This mismatch between regex expectations and parser behavior creates a filter evasion path.

Attack Vector

An attacker interacts with an application built on Langroid's SQLChatAgent through natural-language prompts that produce SQL queries. The attacker crafts a query invoking pg_read_file with a quoted identifier, inline comment, or schema prefix inserted before the parenthesis. The regex blocklist fails to match the modified call. The sqlglot allowlist accepts the statement because it remains a SELECT. PostgreSQL executes the function and returns file contents from the database server's filesystem. See the GitHub Security Advisory for technical details on the bypass forms.

Detection Methods for CVE-2026-54760

Indicators of Compromise

SQL queries invoking pg_read_file with unusual separators such as quoted identifiers or inline comments between the function name and (
PostgreSQL logs showing SELECT statements that reference server-side file paths
Unexpected access to filesystem paths like /etc/passwd or PostgreSQL configuration files via database queries
LLM application logs containing prompts that reference file reads or system paths

Detection Strategies

Enable PostgreSQL statement logging and alert on any reference to pg_read_file, pg_ls_dir, or pg_read_binary_file regardless of formatting
Parse queries at the database layer using an AST-based inspector rather than regex to identify dangerous function calls
Monitor Langroid application traffic for prompts that attempt to elicit file paths or filesystem contents

Monitoring Recommendations

Ingest PostgreSQL query logs and Langroid application logs into a centralized analytics platform for correlation
Track version metadata of the Langroid package across all deployments to identify hosts running vulnerable releases
Alert on any successful SELECT output containing filesystem content patterns such as shell prompts or configuration keys

How to Mitigate CVE-2026-54760

Immediate Actions Required

Upgrade Langroid to version 0.65.1 or later, which addresses the regex bypass
Audit PostgreSQL role permissions and revoke pg_read_server_files from application database users
Review historical query logs for evidence of pg_read_file invocations using bypass syntax

Patch Information

Langroid version 0.65.1 fixes the issue by strengthening the detection logic for dangerous PostgreSQL functions. Refer to the GitHub Security Advisory GHSA-6xc5-4r68-67fc for full remediation details and commit references.

Workarounds

Run the application database user with the least privilege, ensuring it cannot invoke pg_read_file or other superuser-only functions
Restrict the PostgreSQL role used by SQLChatAgent to specific schemas and tables with explicit GRANT statements
Deploy a database proxy that parses queries with a full SQL parser and rejects any use of blocklisted functions regardless of formatting

bash

# Configuration example: upgrade Langroid and restrict database privileges
pip install --upgrade 'langroid>=0.65.1'

# In PostgreSQL, restrict the application role
REVOKE pg_read_server_files FROM langroid_app_user;
REVOKE EXECUTE ON FUNCTION pg_read_file(text) FROM langroid_app_user;
REVOKE EXECUTE ON FUNCTION pg_read_file(text, bigint, bigint) FROM langroid_app_user;