Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

CVE-2026-54760: SQLChatAgent in PostgreSQL can be bypassed by malicious queries

GHSA-6xc5-4r68-67fc CVE-2026-54760 GHSA-6xc5-4r68-67fc CVE-2026-54760 CVE-2026-54760
Summary

A security flaw in PostgreSQL's SQLChatAgent allows hackers to bypass safety checks and execute malicious queries. This can lead to unauthorized access to sensitive data. To fix this issue, update your PostgreSQL installation to the latest version.

What to do
  • Update langroid to version 0.65.1.
Affected software
Ecosystem VendorProductAffected versions
pip – langroid <= 0.65.0
Fix: upgrade to 0.65.1
PyPI – langroid < 0.65.1
Fix: upgrade to 0.65.1
– langroid langroid < 0.65.1
Original title
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Original description
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS`) with a `sqlglot` SELECT-only statement allowlist. The blocklist entries that target callable functions require the function name to be immediately followed by `\s*\(`. PostgreSQL accepts the same call with the name separated from `(` by a quoted identifier, an inline comment, or schema qualification. These forms evade the regex, still parse as `SELECT`, and execute the same PostgreSQL function. This restores the `pg_read_file` server-side file-read primitive that the prior CVE-2026-25879 / GHSA-pmch-g965-grmr fix was meant to block: the parent advisory fixed a missing `pg_read_file` blocklist entry, while this report shows that the added regex is bypassable. Version 0.65.1 fixes the issue.
ghsa CVSS4.0 9.3
Vulnerability type
CWE-22 Path Traversal
CWE-89 SQL Injection
Published: 9 Jul 2026 · Updated: 20 Jul 2026 · First seen: 6 Jul 2026