Langroid’s SQLChatAgent component attempts to mitigate SQL injection by using a regular‑expression blocklist of dangerous PostgreSQL functions and a SELECT‑only allowlist. The blocklist requires the function name to be immediately followed by an opening parenthesis, but PostgreSQL accepts several syntactic variants—quoted identifiers, inline comments, or schema-qualified names—that bypass the regex yet still parse as SELECT. This allows execution of functions such as pg_read_file, giving the attacker a server‑side file‑read capability that was originally mitigated in a prior release.

The vulnerability affects the open‑source Langroid framework, specifically versions earlier than 0.65.1, when the SQLChatAgent runs with its default setting allow_dangerous_operations=False. In these configurations, any user that can trigger the query generation interface and whose database role possesses the right to run pg_read_file can read arbitrary files on the database host. The exploitation also depends on the database server accepting the injected query without additional parameterization.

The CVSS score of 9.3 classifies this issue as critical, while the EPSS score of less than 1 % indicates a low but non‑zero likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it by submitting a designed query via Langroid’s interface; the bypass relies on improper function‑name validation (CWE‑89) and affords a path‑influenced file read (CWE‑22) under privileged database context.