CVE-2026-54760: Langroid SQLChatAgent regex bypass

CISO Take

Langroid's SQLChatAgent ships a raw-text regex blocklist meant to stop dangerous PostgreSQL function calls, but the regex only catches the function name when it's immediately followed by an opening parenthesis — quoting the name, inserting a `/**/` comment, or schema-qualifying it (`pg_catalog."pg_read_file"`) all slip through untouched while `sqlglot` still validates the statement as a harmless SELECT. This re-opens the exact `pg_read_file` server-side file-read primitive that the parent advisory (GHSA-pmch-g965-grmr) was supposed to close, so any deployment that already patched the earlier issue is not actually protected. Blast radius is narrow — only 4 known downstream dependents and no CISA KEV listing, EPSS data, or public exploit/scanner exists — but the precondition is realistic: any SQLChatAgent pointed at PostgreSQL where the connecting role is superuser or holds `pg_read_server_files` is exploitable the moment an attacker can steer the LLM's generated SQL. Patch to langroid 0.65.1 immediately, and independent of patch status, strip `pg_read_server_files`/superuser from the database role SQLChatAgent uses so the guard's failure mode is a validation error, not a file leak.

Sources: GitHub Advisory ATLAS

What is the risk?

No CVSS, EPSS, or KEV data is published for this CVE, and there is no public exploit code or Nuclei template — this is a freshly disclosed, low-visibility finding rather than an actively exploited one. That said, exploitability itself is trivial once an attacker can influence the SQL text the agent generates: the bypass strings (quoted identifier, inline comment, schema qualification) are copy-paste PostgreSQL syntax, not novel research, and the report includes a working reproduction against a live PostgreSQL 16 instance. The report's own author rates severity as High (not Critical) by parity with the parent advisory, which is a more defensible read than the internal 'critical' severity tag on this record given the exposure requires a privileged database role. Overall: low current exploitation likelihood, but high consequence and low attacker effort if the precondition (SQLChatAgent + a DB role with file-read functions) is present.

How does the attack unfold?

Attacker influence on SQL generation

Attacker crafts a query or injects content that steers SQLChatAgent toward generating SQL calling a blocked PostgreSQL function.

AML.T0051

Blocklist evasion

The generated SQL uses a quoted, commented, or schema-qualified form of the function name that the raw-text regex blocklist fails to match while still parsing as a valid SELECT.

AML.T0053

Privileged execution

The validated query executes against PostgreSQL under a role with file-read privileges (superuser or pg_read_server_files), invoking pg_read_file.

Data exfiltration

Server-side file contents are returned in the agent's response, giving the attacker read access to files accessible to the PostgreSQL process.

AML.T0025

Attacker influence on SQL generation

Attacker crafts a query or injects content that steers SQLChatAgent toward generating SQL calling a blocked PostgreSQL function.

AML.T0051

Blocklist evasion

The generated SQL uses a quoted, commented, or schema-qualified form of the function name that the raw-text regex blocklist fails to match while still parsing as a valid SELECT.

AML.T0053

Privileged execution

The validated query executes against PostgreSQL under a role with file-read privileges (superuser or pg_read_server_files), invoking pg_read_file.

Data exfiltration

Server-side file contents are returned in the agent's response, giving the attacker read access to files accessible to the PostgreSQL process.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langroid	pip	<= 0.65.0	`0.65.1`
4.1K 4 dependents Pushed 2d ago 100% patched ~14d to patch Full package profile →

Do you use Langroid? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade to langroid >= 0.65.1 immediately. Until upgraded, run SQLChatAgent only against a least-privilege PostgreSQL role that lacks pg_read_server_files and is not superuser — this closes the impact even if the regex is bypassed. Where possible, replace regex-based dangerous-call detection with AST-level validation: after sqlglot parses the query, walk the parsed tree and reject any function call whose normalized (unquoted, schema-stripped, case-folded) name matches a dangerous set (pg_read_file, pg_read_binary_file, pg_ls_dir, pg_stat_file, lo_import, lo_export, load_file, load_extension). For detection, log and alert on SQLChatAgent-generated queries containing quoted identifiers, inline comments (/* */), or schema-qualified calls to system catalog functions — these are strong indicators of blocklist-evasion attempts rather than normal LLM-generated SQL.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Prompt Injection Agent Framework AML.T0025 - Exfiltration via Cyber Means AML.T0051 - LLM Prompt Injection AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Annex A.6 - AI system operational controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM01 - Prompt Injection LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-54760?

Langroid's SQLChatAgent ships a raw-text regex blocklist meant to stop dangerous PostgreSQL function calls, but the regex only catches the function name when it's immediately followed by an opening parenthesis — quoting the name, inserting a `/**/` comment, or schema-qualifying it (`pg_catalog."pg_read_file"`) all slip through untouched while `sqlglot` still validates the statement as a harmless SELECT. This re-opens the exact `pg_read_file` server-side file-read primitive that the parent advisory (GHSA-pmch-g965-grmr) was supposed to close, so any deployment that already patched the earlier issue is not actually protected. Blast radius is narrow — only 4 known downstream dependents and no CISA KEV listing, EPSS data, or public exploit/scanner exists — but the precondition is realistic: any SQLChatAgent pointed at PostgreSQL where the connecting role is superuser or holds `pg_read_server_files` is exploitable the moment an attacker can steer the LLM's generated SQL. Patch to langroid 0.65.1 immediately, and independent of patch status, strip `pg_read_server_files`/superuser from the database role SQLChatAgent uses so the guard's failure mode is a validation error, not a file leak.

Is CVE-2026-54760 actively exploited?

No confirmed active exploitation of CVE-2026-54760 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54760?

Upgrade to langroid >= 0.65.1 immediately. Until upgraded, run SQLChatAgent only against a least-privilege PostgreSQL role that lacks `pg_read_server_files` and is not superuser — this closes the impact even if the regex is bypassed. Where possible, replace regex-based dangerous-call detection with AST-level validation: after `sqlglot` parses the query, walk the parsed tree and reject any function call whose normalized (unquoted, schema-stripped, case-folded) name matches a dangerous set (`pg_read_file`, `pg_read_binary_file`, `pg_ls_dir`, `pg_stat_file`, `lo_import`, `lo_export`, `load_file`, `load_extension`). For detection, log and alert on SQLChatAgent-generated queries containing quoted identifiers, inline comments (`/* */`), or schema-qualified calls to system catalog functions — these are strong indicators of blocklist-evasion attempts rather than normal LLM-generated SQL.

What systems are affected by CVE-2026-54760?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, text-to-SQL / database-connected agents, internal BI copilots.

What is the CVSS score for CVE-2026-54760?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkstext-to-SQL / database-connected agentsinternal BI copilots

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0051 LLM Prompt Injection

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: Annex A.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS`) with a `sqlglot` SELECT-only statement allowlist. The blocklist entries that target callable functions require the function name to be immediately followed by `\s*\(`. PostgreSQL accepts the same call with the name separated from `(` by a quoted identifier, an inline comment, or schema qualification. These forms evade the regex, still parse as `SELECT`, and execute the same PostgreSQL function. This restores the `pg_read_file` server-side file-read primitive that the prior CVE-2026-25879 / GHSA-pmch-g965-grmr fix was meant to block: the parent advisory fixed a missing `pg_read_file` blocklist entry, while this report shows that the added regex is bypassable. Version 0.65.1 fixes the issue.

Exploitation Scenario

An analyst deploys a Langroid SQLChatAgent as an internal 'ask your database' copilot, connected to PostgreSQL with a role that (for convenience) has superuser or `pg_read_server_files` privileges. An attacker with access to the chat interface — or who plants instructions in a document the agent ingests as context — steers the agent toward generating `SELECT pg_catalog."pg_read_file"('/etc/passwd')` or an equivalent obfuscated form instead of a direct `pg_read_file(...)` call. The raw-text regex blocklist doesn't match the quoted/qualified form, `sqlglot` confirms it's a syntactically valid SELECT, and the query passes validation and executes against PostgreSQL, returning the contents of server-side files (credentials, config files, SSH keys) directly in the agent's response to the attacker.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Primary CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.