langroid vulnerabilities (PyPI)
11 vulnerabilities.
-
langroidPyPI Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 9.2 Critical -
langroidPyPI Langroid: handle_message() executes user-supplied tool JSON without sender verification 8.1 High -
langroidPyPI Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent 10.0 Critical -
langroidPyPI Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls 9.3 Critical -
langroidPyPI Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read 8.7 High -
langroidPyPI Langroid: Path traversal in the file tools allows read/write outside configured current directory 7.1 High -
langroidPyPI Langroid has Prompt to SQL Injection, Leading to RCE 9.8 Critical -
langroidPyPI Langroid has WAF Bypass Leading to RCE in TableChatAgent 9.4 Critical -
langroidPyPI Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store 8.1 High -
langroidPyPI Langroid has a Code Injection vulnerability in TableChatAgent 9.8 Critical -
langroidPyPI Langroid Vulnerable to XXE Injection via XMLToolMessage 7.8 High