langroid vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 20268

Newest CVEs

• CVE-2026-54771

  Langroid: handle_message() executes user-supplied tool JSON without sender verification

  langroid · langroid

  High8.1
• CVE-2026-54769

  Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

  langroid · langroid

  Critical10.0
• CVE-2026-54760

  Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

  langroid · langroid

  Critical9.3
• CVE-2026-50181

  Langroid: Path traversal in the file tools allows read/write outside configured current directory

  langroid · langroid

  High7.1
• CVE-2026-50180

  Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

  langroid · langroid

  High8.7
• CVE-2026-55615

  Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

  langroid · langroid

  Critical9.2
• CVE-2026-25879

  Langroid has Prompt to SQL Injection, Leading to RCE

  langroid · langroid

  Critical9.8
• CVE-2026-25481

  Langroid has WAF Bypass Leading to RCE in TableChatAgent

  langroid · langroid

  Critical9.4
• CVE-2025-46725

  Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

  langroid · langroid

  High8.1
• CVE-2025-46724

  Langroid has a Code Injection vulnerability in TableChatAgent

  langroid · langroid

  Critical9.8