Langroid's SQLChatAgent provides a defensive layer that relies on a regular expression blocklist. The list omitted the PostgreSQL file‑reading family of functions (pg_read_file, pg_stat_file, pg_ls_logdir, pg_ls_waldir, pg_current_logfile) and also failed to block certain SQL Server and SQLite file‑access functions. An attacker who can influence the language‑model output, for example by submitting a prompt that steers the model into generating a SELECT statement containing one of these functions, can thus read arbitrary files from the PostgreSQL host. The flaw persists even when the agent is configured with allow_dangerous_operations = False and allowed_statement_types limited to SELECT, because the problematic function names are not detected by the regex and the statements remain SELECT queries.

This vulnerability affects all installations of the Langroid framework that use SQLChatAgent from versions earlier than 0.64.0. The defect resides in the library code bundled with the agent, so any application that imports SQLChatAgent from those older releases—or deploys a custom agent that relies on the same blocklist—is vulnerable. Users of langroid < 0.64.0 should verify their installed version and plan to update or apply a workaround.

The CVSS base score of 8.7 reflects high severity and the potential for arbitrary information disclosure. The EPSS score of < 1 % indicates a very low probability of exploitation in the wild, likely due to the need for logical access to the prompt content that feeds the LLM. The flaw is not listed in the CISA KEV catalog. A successful exploit requires the attacker to craft or influence the model’s generated SQL, so the attack vector is logical/prompt path rather than a direct network attack. If the attacker succeeds, they can read any file on the database host that the PostgreSQL process can access, potentially revealing credentials, application configuration or other sensitive data.