Langroid’s SQLChatAgent uses a regular‑expression blocklist to forbid dangerous PostgreSQL function calls such as pg_read_file, a remedy considered to mitigate SQL injection (CWE‑89). The blocklist requires the function name to be immediately followed by an opening parenthesis, but PostgreSQL accepts the same call when the identifier is quoted, contains an inline comment, or is prefixed by a schema name. These variations bypass the regex, still produce a valid SELECT statement, and allow the execution of pg_read_file. The result is a classic SQL injection that enables an attacker to read arbitrary files on the database server, revealing a CWE‑22 path‑influenced file read as part of the attack. The flaw resides in the SQLChatAgent component configured with the default setting allow_dangerous_operations=False in versions earlier than 0.65.1.

Langroid, the open‑source framework for building large‑language‑model applications, is affected when its SQLChatAgent component uses the default configuration with allow_dangerous_operations set to False. Versions earlier than 0.65.1 are vulnerable because the blocklist can be bypassed, enabling dangerous PostgreSQL function calls such as pg_read_file. The database user employed by Langroid must at least have the vulnerability to be fully exploitable.

The CVSS score of 9.3 indicates a critical vulnerability, and the EPSS score of less than 1 % shows a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by injecting a quoted or schema‑qualified call to pg_read_file through SQLChatAgent’s query generation interface. The attack leverages improper function‑name validation (CWE‑89) and allows a file‑read primitive that falls under CWE‑22 when the database user is privileged.