9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25879

CVE-2026-25879: Langroid has Prompt to SQL Injection, Leading to RCE

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.63.0, SQLChatAgent executes SQL produced by an LLM, which is influenceable by prompt injection. When configured with a database role that has privileges enabling code execution or filesystem access (e.g., PostgreSQL pg_execute_server_program, MySQL FILE, MSSQL xp_cmdshell), an attacker who can shape the agent's input — including indirectly via data returned to the LLM — can coerce execution of dialect-specific primitives such as COPY ... FROM PROGRAM, achieving RCE on the database host. Fixed in v0.63.0 by defaulting SQLChatAgent to a SELECT-only sqlglot-parsed statement allowlist with a dialect-aware dangerous-pattern blocklist; allow_dangerous_operations=True restores the previous unrestricted behavior for trusted deployments.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25879

CVE-2026-25879:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langroid	pip	< 0.63.0	0.63.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the SQLChatAgent class within the langroid library, specifically in the run_query method. This method is designed to execute SQL queries generated by an LLM. The core of the vulnerability lies in the trust placed in the LLM's output. The agent would execute any SQL query provided by the model without verification. An attacker could exploit this by using prompt injection to manipulate the LLM into generating malicious SQL statements. The provided proof-of-concept demonstrates this by base64-encoding a malicious SQL payload, which the LLM is instructed to decode and execute. This payload uses a PostgreSQL-specific command (COPY ... FROM PROGRAM) to achieve remote code execution on the database host.

The fixing commit (60933b4860a8952894b31caa0dd3f9dcba512c8e) addresses this by introducing a validation layer. A new method, _validate_query, is added, which is called at the start of run_query. This new method uses the sqlglot library to parse the incoming SQL query and checks it against a configurable allowlist of statement types (defaulting to ["SELECT"]) and a blocklist of known dangerous SQL patterns. By default, any query that is not a SELECT statement or contains dangerous constructs is rejected, thus preventing the SQL injection and subsequent RCE. The vulnerable function is SQLChatAgent.run_query as it was the entry point for executing the unsanitized, user-influenced SQL query.

Vulnerable functions

SQLChatAgent.run_query

langroid/agent/special/sql/sql_chat_agent.py

The `run_query` function in the `SQLChatAgent` class is responsible for executing SQL queries generated by a large language model (LLM). Prior to the patch, this function did not perform any validation or sanitization on the SQL query it received. An attacker could craft a prompt that would cause the LLM to generate a malicious SQL query. When `run_query` executed this query, it would lead to arbitrary command execution on the database server, as demonstrated by the proof-of-concept using `COPY ... FROM PROGRAM` in PostgreSQL.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.