Langroid vulnerabilities

Products

• Langroid 11

Newest

• langroid Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 CVE-2026-55615 Fix available 9.2 CriticalJuly 6, 2026
• langroid Langroid: handle_message() executes user-supplied tool JSON without sender verification CVE-2026-54771 Fix available 8.1 HighJuly 6, 2026
• langroid Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent CVE-2026-54769 Fix available 10.0 CriticalJuly 6, 2026
• langroid Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls CVE-2026-54760 Fix available 9.3 CriticalJuly 6, 2026
• langroid Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read CVE-2026-50180 Fix available 8.7 HighJuly 2, 2026
• langroid Langroid: Path traversal in the file tools allows read/write outside configured current directory CVE-2026-50181 Public exploitFix available 7.1 HighJuly 2, 2026
• langroid Langroid has Prompt to SQL Injection, Leading to RCE CVE-2026-25879 Fix available 9.8 CriticalMay 27, 2026
• langroid Langroid has WAF Bypass Leading to RCE in TableChatAgent CVE-2026-25481 Fix available 9.4 CriticalFebruary 2, 2026
• langroid Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store CVE-2025-46725 Fix available 8.1 HighMay 20, 2025
• langroid Langroid has a Code Injection vulnerability in TableChatAgent CVE-2025-46724 Fix available 9.8 CriticalMay 20, 2025
• langroid Langroid Vulnerable to XXE Injection via XMLToolMessage CVE-2025-46726 Fix available 7.8 HighMay 5, 2025