CVE-2026-25879
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedLangroid is a framework for building large-language-model-powered applications. Prior to version 0.63.0, SQLChatAgent executes SQL produced by an LLM, which is influenceable by prompt injection. When configured with a database role that has privileges enabling code execution or filesystem access (e.g., PostgreSQL pg_execute_server_program, MySQL FILE, MSSQL xp_cmdshell), an attacker who can shape the agent's input — including indirectly via data returned to the LLM — can coerce execution of dialect-specific primitives such as `COPY ... FROM PROGRAM`, achieving RCE on the database host. Fixed in v0.63.0 by defaulting SQLChatAgent to a SELECT-only sqlglot-parsed statement allowlist with a dialect-aware dangerous-pattern blocklist; allow_dangerous_operations=True restores the previous unrestricted behavior for trusted deployments.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceSQLChatAgent in Langroid executes LLM-generated SQL without sanitization, enabling prompt injection attacks to craft malicious SQL. When the database role has elevated privileges (pg_execute_server_program, MySQL FILE, xp_cmdshell), attackers can use dialect-specific primitives like COPY...FROM PROGRAM to achieve RCE on the database host.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the installed Langroid versionCheck the installed package version using pip show langroid or your package manager. Compare the version number to 0.63.0 - any version below 0.63.0 is affected.Affected if The installed Langroid version is less than 0.63.0
-
Verify SQLChatAgent is in useSearch your codebase for imports or usage of SQLChatAgent class from langroid. Review configuration files where agent types are specified.Affected if SQLChatAgent is instantiated or configured in your application
-
Identify the database user role used by SQLChatAgentReview your application configuration or environment variables to determine which database user/role the Langroid SQLChatAgent connects with. Check connection strings or credential sources.Affected if A specific database user credential is used for SQLChatAgent connections
-
Check PostgreSQL role for dangerous privilegesQuery the database: SELECT rolname, rolsuper, rolinherit, rolcanlogin FROM pg_roles WHERE rolname = 'your_user'. For pg_execute_server_program, query: SELECT * FROM pg_roles WHERE rolname = 'your_user' AND pg_has_role('your_user', 'pg_execute_server_program', 'member');Affected if The database user is a member of the pg_execute_server_program role or has superuser privileges in PostgreSQL
-
Check MySQL user FILE privilegesQuery MySQL: SHOW GRANTS FOR 'your_user'@'your_host'; Look for the FILE privilege in the output.Affected if The MySQL user has the FILE privilege granted
-
Check SQL Server for xp_cmdshell availabilityQuery SQL Server: SELECT value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell'; Also check if the database user has the sysadmin server role.Affected if xp_cmdshell is enabled or the user has sysadmin privileges in SQL Server
You are affected if you use Langroid below version 0.63.0 with SQLChatAgent AND the database role it uses has elevated privileges (pg_execute_server_program, MySQL FILE, or xp_cmdshell).
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to Langroid v0.63.0 which defaults to SELECT-only sqlglot-parsed allowlist with dangerous-pattern blocking; audit and revoke elevated database privileges unless explicitly required; avoid setting allow_dangerous_operations=True in untrusted environments.
Langroid v0.63.0
- Upgrade Langroid to version 0.63.0 or later using your package manager (e.g., pip install langroid>=0.63.0 or pip install --upgrade langroid)
- After upgrading, verify that SQLChatAgent now defaults to SELECT-only operations via sqlglot parsing
- Test your application to ensure legitimate SQL queries work with the new restrictive default
- If your application requires DDL/DML operations (INSERT, UPDATE, DELETE, CREATE, etc.), explicitly set allow_dangerous_operations=True in your SQLChatAgent configuration, but only in trusted deployments
- Audit your database user permissions to ensure the role used by SQLChatAgent does not have privileges for pg_execute_server_program (PostgreSQL), FILE (MySQL), or xp_cmdshell (MSSQL) unless explicitly required and secured
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation2.0 h
- Testing6.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,872.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-25879 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-25879 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data