CVE-2026-54760: 
Python vulnerability analysis and mitigation

CVE-2026-54760 is a SQL injection / path traversal vulnerability in Langroid's SQLChatAgent component that allows an attacker who can influence LLM-generated SQL to bypass the dangerous-function blocklist and invoke PostgreSQL file-read primitives such as pg_read_file. It affects all Langroid versions up to and including 0.65.0 (pip package). The vulnerability was published on June 9, 2026, and patched in version 0.65.1 released July 6, 2026. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory). This is a bypass of the prior fix for CVE-2026-25879 / GHSA-pmch-g965-grmr, which added a pg_read_file regex block that this vulnerability circumvents (GitHub Advisory).

The root cause (CWE-89, CWE-22) lies in SQLChatAgent._validate_query, which enforces safety using a raw-text regex blocklist (_DANGEROUS_SQL_PATTERNS) combined with a sqlglot SELECT-only allowlist. The regex pattern re.compile(r"\bpg_(read|stat|ls|current_logfile)[A-Za-z0-9_]*\s*\(", re.IGNORECASE) requires the dangerous function name to be immediately followed by optional whitespace and (, but PostgreSQL accepts equivalent calls where the function name is separated from ( by a quoted identifier (e.g., "pg_read_file"), an inline comment (e.g., pg_read_file/**/(), or schema qualification (e.g., pg_catalog."pg_read_file"). Because _validate_query only uses sqlglot to enforce the top-level statement type and never walks the parsed AST to normalize function names, these obfuscated forms pass validation and execute on the database. Exploitation requires that untrusted user content can influence the SQL generated by SQLChatAgent and that the connected PostgreSQL role has pg_read_server_files privileges or is a superuser (GitHub Advisory).

Successful exploitation allows an attacker to read arbitrary files accessible to the PostgreSQL server process via pg_read_file, pg_read_binary_file, pg_ls_dir, and related functions, resulting in high confidentiality impact (e.g., exposure of /etc/passwd, configuration files, or application secrets). Integrity and availability of the vulnerable system are also rated high in the CVSS v4.0 assessment. The attack is limited to deployments where SQLChatAgent connects to PostgreSQL with a privileged role; it does not represent a product-wide unauthenticated SQL injection but is scoped to the LLM-to-database trust boundary (GitHub Advisory).

1. Identify a target deployment: Locate an application using Langroid's SQLChatAgent (pip package ≤ 0.65.0) connected to a PostgreSQL backend where the database role has superuser privileges or has been granted pg_read_server_files.
2. Craft a bypass payload: Formulate a SQL query that uses one of the three PostgreSQL-accepted obfuscation forms to invoke pg_read_file while evading the regex blocklist:
   • Quoted identifier: SELECT "pg_read_file"('/etc/passwd')
   • Inline comment: SELECT pg_read_file/**/('/etc/passwd')
   • Schema-qualified quoted name: SELECT pg_catalog."pg_read_file"('/etc/passwd')
3. Inject via LLM prompt: Influence the user prompt or input that SQLChatAgent passes to the LLM so that the LLM generates one of the bypass queries as its SQL output (e.g., through prompt injection or direct user query input).
4. Bypass validation: The crafted query passes _validate_query because it does not match the _DANGEROUS_SQL_PATTERNS regex and sqlglot parses it as a valid SELECT statement.
5. Achieve file read: The query is forwarded to PostgreSQL, which executes pg_read_file and returns the contents of the target file to the attacker via the agent's response (GitHub Advisory).

• Logs: PostgreSQL query logs (log_statement = all) showing queries containing "pg_read_file", pg_read_file/**/, or pg_catalog."pg_read_file" patterns; application logs showing SQLChatAgent executing SELECT statements with quoted or schema-qualified pg_ function names.
• Network: Unexpected data volumes returned from the database to the application layer for queries that should return minimal results; LLM agent responses containing file content (e.g., /etc/passwd entries, configuration key-value pairs).
• Database: PostgreSQL pg_stat_activity or audit logs showing pg_read_file, pg_read_binary_file, or pg_ls_dir calls originating from the Langroid application database user with obfuscated syntax.
• File System: Evidence of sensitive file contents (e.g., /etc/passwd, SSL certificates, .env files) appearing in application output or logs where database query results are stored.

Upgrade the Langroid pip package to version 0.65.1 or later, which fixes the bypass by replacing raw-text regex matching with AST-level function name normalization after sqlglot parsing (GitHub Advisory). As a defense-in-depth measure, configure the PostgreSQL role used by SQLChatAgent with least privilege — specifically, ensure it does not have superuser rights and has not been granted pg_read_server_files, which removes the ability to call pg_read_file regardless of query content. The advisory also recommends that any dangerous-function detection be performed by walking the parsed SQL AST and rejecting calls whose normalized, unquoted, schema-stripped, case-folded names match a blocklist including pg_read_file, pg_read_binary_file, pg_ls_dir, pg_stat_file, lo_import, lo_export, load_file, and load_extension (GitHub Advisory).

The advisory was published by the Langroid maintainer (pchalasani) directly to the GitHub Security Advisory database and was picked up by automated CVE tracking services including OSV, Vulners, GitLab Advisories, INCIBE-CERT, and ENISA EUVD shortly after disclosure. No significant independent researcher commentary or media coverage beyond standard vulnerability aggregation has been identified for this CVE.