CVE-2026-54760: 
Python vulnerability analysis and mitigation

CVE-2026-54760 is a SQL injection / path traversal vulnerability in Langroid's SQLChatAgent component that allows an attacker who can influence LLM-generated SQL to bypass the dangerous-function blocklist and invoke PostgreSQL file-read primitives such as pg_read_file. It affects all Langroid versions up to and including 0.65.0 (pip package). The vulnerability was published on June 9, 2026, and patched in version 0.65.1 released July 6, 2026. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory). This issue is a bypass of the prior fix for CVE-2026-25879 / GHSA-pmch-g965-grmr, which added a pg_read_file blocklist entry that this report demonstrates is circumventable (GitHub Advisory).

The root cause (CWE-89, CWE-22) lies in SQLChatAgent._validate_query, which enforces safety through two layers: a raw-text regex blocklist (_DANGEROUS_SQL_PATTERNS) and a sqlglot-based SELECT-only allowlist. The regex pattern re.compile(r"\bpg_(read|stat|ls|current_logfile)[A-Za-z0-9_]*\s*\(", re.IGNORECASE) requires the dangerous function name to be immediately followed by optional whitespace and (, but PostgreSQL accepts semantically equivalent calls where the function name is separated from ( by a quoted identifier (e.g., "pg_read_file"), an inline comment (e.g., pg_read_file/**/(), or schema qualification (e.g., pg_catalog."pg_read_file"). All three bypass forms still parse as valid SELECT statements under sqlglot, so they pass both validation layers and execute on the database. Because _validate_query never walks the parsed AST to check normalized, unquoted function names, the dangerous-call detection is entirely defeated by these PostgreSQL syntactic equivalences (GitHub Advisory).

On deployments where SQLChatAgent connects to PostgreSQL with a superuser role or a role granted pg_read_server_files, a successful exploit allows an attacker to read arbitrary files accessible to the PostgreSQL server process via pg_read_file, pg_read_binary_file, or related functions. This exposes sensitive server-side files such as /etc/passwd, PostgreSQL configuration files, SSL private keys, or application secrets. The CVSS v4.0 assessment rates confidentiality, integrity, and availability impact on the vulnerable system as High, reflecting the potential for significant data exfiltration and system compromise (GitHub Advisory).

1. Identify a target: Locate a Langroid deployment (version ≤ 0.65.0) using SQLChatAgent connected to a PostgreSQL database where the database role has superuser privileges or the pg_read_server_files permission.
2. Craft a bypass payload: Formulate a SQL query that invokes pg_read_file using one of the three bypass forms that evade the regex blocklist:
   • Quoted identifier: SELECT "pg_read_file"('/etc/passwd')
   • Inline comment: SELECT pg_read_file/**/('/etc/passwd')
   • Schema-qualified quoted name: SELECT pg_catalog."pg_read_file"('/etc/passwd')
3. Inject via LLM-influenced input: Supply the crafted SQL (or a natural-language prompt that causes the LLM to generate it) through any user-controlled input channel that feeds into SQLChatAgent's SQL generation pipeline.
4. Bypass validation: The _validate_query method checks the raw query against _DANGEROUS_SQL_PATTERNS (no match due to the syntactic obfuscation) and then parses it with sqlglot (accepted as a valid SELECT statement), returning None (allowed).
5. Achieve file read: The query is forwarded to PostgreSQL, which resolves the obfuscated function name to pg_read_file and returns the contents of the target file to the attacker (GitHub Advisory).

• Database Logs: PostgreSQL query logs (log_statement = all) showing SELECT statements containing "pg_read_file", pg_read_file/**/, pg_catalog."pg_read_file", or similar quoted/commented/schema-qualified variants of pg_read_file, pg_read_binary_file, pg_ls_dir, or pg_stat_file.
• Application Logs: Langroid/SQLChatAgent logs showing queries that were validated and passed to the database containing the above patterns, particularly where _validate_query returned None for such inputs.
• Network: Unexpected outbound data transfers from the database host following SQL query execution, potentially indicating exfiltration of file contents returned by pg_read_file.
• Database Activity: PostgreSQL pg_stat_activity entries showing active or recent queries invoking file-read functions from the Langroid application database user.

Upgrade Langroid to version 0.65.1 or later, which fixes the bypass by replacing raw-text regex matching with AST-level function-name inspection after sqlglot parsing (GitHub Advisory). As a defense-in-depth measure regardless of patch status, configure the PostgreSQL role used by SQLChatAgent with least privilege — specifically, revoke pg_read_server_files membership and avoid superuser roles, so that even if the guard is bypassed, pg_read_file cannot be called. The advisory also recommends that the fix walk the parsed SQL AST and reject any function invocation whose normalized, unquoted, schema-stripped, case-folded name appears in the dangerous set (e.g., pg_read_file, pg_read_binary_file, pg_ls_dir, pg_stat_file, lo_import, lo_export) (GitHub Advisory).

The advisory was published by Langroid maintainer pchalasani on June 9, 2026, and formally added to the GitHub Advisory Database on July 6, 2026. The vulnerability was noted in automated CVE tracking feeds including INCIBE-CERT and Bluesky CVE notification accounts shortly after NVD publication. No significant independent researcher commentary or media coverage beyond standard vulnerability database aggregation has been identified.