CVE-2026-54760

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54760
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54760.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54760
Aliases
Published
2026-07-09T23:49:52Z
Modified
2026-08-12T03:51:49Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Details

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the SQLChatAgent SQL-injection mitigation, with default allow_dangerous_operations=False, combines a raw-text regex blocklist (_DANGEROUS_SQL_PATTERNS) with a sqlglot SELECT-only statement allowlist. The blocklist entries that target callable functions require the function name to be immediately followed by \s*\(. PostgreSQL accepts the same call with the name separated from ( by a quoted identifier, an inline comment, or schema qualification. These forms evade the regex, still parse as SELECT, and execute the same PostgreSQL function. This restores the pg_read_file server-side file-read primitive that the prior CVE-2026-25879 / GHSA-pmch-g965-grmr fix was meant to block: the parent advisory fixed a missing pg_read_file blocklist entry, while this report shows that the added regex is bypassable. Version 0.65.1 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54760.json"
}
References

Affected packages

Git / github.com/langroid/langroid

Affected ranges

Type
GIT
Repo
https://github.com/langroid/langroid
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3ce09e58569bb36fb7e14f2d86e46ec5dd7e1e78
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.65.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.100
0.1.101
0.1.103
0.1.104
0.1.106
0.1.107
0.1.109
0.1.110
0.1.113
0.1.116
0.1.118
0.1.119
0.1.120
0.1.122
0.1.124
0.1.127
0.1.128
0.1.130
0.1.131
0.1.132
0.1.133
0.1.134
0.1.135
0.1.136
0.1.137
0.1.138
0.1.139
0.1.140
0.1.142
0.1.143
0.1.144
0.1.146
0.1.147
0.1.148
0.1.149
0.1.150
0.1.151
0.1.152
0.1.153
0.1.155
0.1.158
0.1.159
0.1.16
0.1.160
0.1.161
0.1.162
0.1.164
0.1.165
0.1.166
0.1.167
0.1.168
0.1.169
0.1.17
0.1.170
0.1.171
0.1.172
0.1.173
0.1.176
0.1.177
0.1.178
0.1.179
0.1.18
0.1.180
0.1.181
0.1.183
0.1.184
0.1.185
0.1.186
0.1.188
0.1.189
0.1.191
0.1.192
0.1.194
0.1.196
0.1.198
0.1.199
0.1.20
0.1.200
0.1.201
0.1.202
0.1.203
0.1.205
0.1.206
0.1.207
0.1.208
0.1.209
0.1.21
0.1.210
0.1.212
0.1.213
0.1.214
0.1.216
0.1.217
0.1.218
0.1.219
0.1.22
0.1.221
0.1.222
0.1.224
0.1.225
0.1.226
0.1.227
0.1.228
0.1.229
0.1.23
0.1.230
0.1.231
0.1.232
0.1.233
0.1.234
0.1.235
0.1.236
0.1.237
0.1.238
0.1.239
0.1.24
0.1.240
0.1.241
0.1.242
0.1.243
0.1.244
0.1.245
0.1.246
0.1.247
0.1.248
0.1.25
0.1.250
0.1.251
0.1.253
0.1.254
0.1.256
0.1.258
0.1.261
0.1.262
0.1.265
0.1.27
0.1.28
0.1.29
0.1.30
0.1.31
0.1.32
0.1.33
0.1.34
0.1.35
0.1.36
0.1.38
0.1.42
0.1.43
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.52
0.1.54
0.1.55
0.1.61
0.1.62
0.1.64
0.1.66
0.1.69
0.1.73
0.1.81
0.1.82
0.1.83
0.1.84
0.1.86
0.1.87
0.1.89
0.1.90
0.1.92
0.1.94
0.1.96
0.1.97
0.1.98
0.1.99
0.10.0
0.10.1
0.11.0
0.12.0
0.13.0
0.14.0
0.15.0
0.15.1
0.15.2
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.17.0
0.17.1
0.18.0
0.18.1
0.18.2
0.18.3
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.2.11
0.2.12
0.2.2
0.2.3
0.2.4
0.2.7
0.2.8
0.2.9
0.20.0
0.20.1
0.21.0
0.22.0
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.23.0
0.23.1
0.23.2
0.23.3
0.24.0
0.24.1
0.25.0
0.26.0
0.26.1
0.26.2
0.27.0
0.27.1
0.27.2
0.27.3
0.27.4
0.28.0
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.28.7
0.29.0
0.3.1
0.30.0
0.30.1
0.31.0
0.31.1
0.31.2
0.31.3
0.32.0
0.32.1
0.32.2
0.33.0
0.33.10
0.33.11
0.33.12
0.33.13
0.33.2
0.33.3
0.33.4
0.33.5
0.33.6
0.33.7
0.33.8
0.33.9
0.34.0
0.34.1
0.35.0
0.35.1
0.36.0
0.36.1
0.37.0
0.37.1
0.37.2
0.37.3
0.37.4
0.37.5
0.37.6
0.37.7
0.38.0
0.39.0
0.39.1
0.39.2
0.39.3
0.39.4
0.39.5
0.4.0
0.40.0
0.41.0
0.41.1
0.41.2
0.41.3
0.41.4
0.41.5
0.42.0
0.42.1
0.42.10
0.42.2
0.42.3
0.42.4
0.42.5
0.42.6
0.42.7
0.42.8
0.42.9
0.43.0
0.43.1
0.44.0
0.44.1
0.45.0
0.45.1
0.45.10
0.45.2
0.45.3
0.45.4
0.45.5
0.45.6
0.45.7
0.45.8
0.45.9
0.47.0
0.47.1
0.47.2
0.48.0
0.48.1
0.48.2
0.48.3
0.49.0
0.49.1
0.5.0
0.5.1
0.50.0
0.50.1
0.50.10
0.50.11
0.50.12
0.50.2
0.50.3
0.50.4
0.50.5
0.50.6
0.50.7
0.50.8
0.50.9
0.51.0
0.51.1
0.51.2
0.52.0
0.52.1
0.52.2
0.52.3
0.52.5
0.52.6
0.52.7
0.52.8
0.52.9
0.53.10
0.53.12
0.53.13
0.53.14
0.53.15
0.53.16
0.53.2
0.53.3
0.53.4
0.53.5
0.53.6
0.53.7
0.53.8
0.53.9
0.54.0
0.54.1
0.54.2
0.55.0
0.55.1
0.56.0
0.56.1
0.56.10
0.56.11
0.56.12
0.56.13
0.56.14
0.56.15
0.56.16
0.56.17
0.56.18
0.56.19
0.56.2
0.56.3
0.56.4
0.56.5
0.56.6
0.56.7
0.56.8
0.56.9
0.57.0
0.58.0
0.58.1
0.58.2
0.58.3
0.59.0
0.59.1
0.59.10
0.59.11
0.59.12
0.59.13
0.59.14
0.59.15
0.59.16
0.59.17
0.59.18
0.59.19
0.59.2
0.59.20
0.59.21
0.59.22
0.59.23
0.59.24
0.59.25
0.59.26
0.59.27
0.59.28
0.59.29
0.59.3
0.59.30
0.59.31
0.59.32
0.59.33
0.59.34
0.59.35
0.59.36
0.59.37
0.59.38
0.59.39
0.59.4
0.59.5
0.59.6
0.59.7
0.59.8
0.59.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.60.0
0.60.1
0.60.2
0.60.3
0.61.0
0.61.1
0.62.0
0.63.0
0.64.0
0.65.0
0.7.0
0.8.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
v0.*
v0.59.0
v0.59.19

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54760.json"