Vulnerabilities

TI-2026-39577 CVE-2026-54771 · GHSA-gjgq-w2m6-wr5q

Langroid: handle_message() executes user-supplied tool JSON without sender verification

HIGH 70

Langroid is a framework for building large-language-model-powered applications.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00392 Published 2026-07-09 Fixed in 0.65.3 CWE-75

TI-2026-39575 CVE-2026-54769 · GHSA-q9p7-wqxg-mrhc

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

HIGH 82

Langroid is a framework for building large-language-model-powered applications.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00912 Published 2026-07-09 Fixed in 0.65.2 CWE-94

TI-2026-39566 CVE-2026-54760 · GHSA-6xc5-4r68-67fc

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

HIGH 81

Langroid is a framework for building large-language-model-powered applications.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00646 Published 2026-07-09 Fixed in 0.65.1 CWE-22

TI-2026-36940 CVE-2026-50181 · GHSA-fg23-3346-88f5

Langroid: Path traversal in the file tools allows read/write outside configured current directory

HIGH 66

Langroid is a framework for building large-language-model-powered applications.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00184 Published 2026-07-09 Fixed in 0.64.0 CWE-22

TI-2026-36939 CVE-2026-50180 · GHSA-pmch-g965-grmr

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

MEDIUM 45

Langroid is a framework for building large-language-model-powered applications.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00686 Published 2026-07-09 Fixed in 0.64.0 CWE-22

TI-2026-40145 CVE-2026-55615 · GHSA-2pq5-3q89-j7cc

Injection in langroid

HIGH 81

Langroid is a framework for building large-language-model-powered applications.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00461 Published 2026-07-09 Fixed in 0.65.5 CWE-74

TI-2026-20919 CVE-2026-25879 · GHSA-mxfr-6hcw-j9rq

Langroid has Prompt to SQL Injection, Leading to RCE

HIGH 82

Langroid is a framework for building large-language-model-powered applications.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00554 Published 2026-06-01 Fixed in 0.63.0 CWE-89

TI-2026-20592 CVE-2026-25481 · GHSA-x34r-63hx-w57f

Langroid has WAF Bypass Leading to RCE in TableChatAgent

HIGH 82

Langroid is a framework for building large-language-model-powered applications.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.00733 Published 2026-02-04 Fixed in 0.59.32 CWE-94

TI-2025-29396 CVE-2025-46725 · GHSA-22c2-9gwg-mj59

Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

MEDIUM 44

Langroid is a Python framework to build large language model (LLM)-powered applications.

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00534 Published 2025-05-20 Fixed in 0.53.15 CWE-94

TI-2025-29395 CVE-2025-46724 · GHSA-jqq5-wc57-f8hj

Langroid has a Code Injection vulnerability in TableChatAgent

HIGH 82

Langroid is a Python framework to build large language model (LLM)-powered applications.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0083 Published 2025-05-20 Fixed in 0.53.15 CWE-94

TI-2025-29397 CVE-2025-46726 · GHSA-pw95-88fg-3j6f

Langroid Vulnerable to XXE Injection via XMLToolMessage

HIGH 73

Langroid is a framework for building large-language-model-powered applications.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.00659 Published 2025-05-05 Fixed in 0.53.4 CWE-611

Vulnerabilities

Filters