Llangroid

Products

Exploited and recent CVEs

• CVE-2026-54771 High 8.1 Langroid: handle_message() executes user-supplied tool JSON without sender verification 0.4%
• CVE-2026-54769 Critical 10.0 Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent 0.9%
• CVE-2026-54760 Critical 9.3 Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls 0.6%
• CVE-2026-50181 High 7.1 Langroid: Path traversal in the file tools allows read/write outside configured current directory 0.2%
• CVE-2026-50180 High 8.7 Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read 0.7%
• CVE-2026-55615 Critical 9.2 Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 0.5%
• CVE-2026-25879 Critical 9.8 Langroid has Prompt to SQL Injection, Leading to RCE 0.6%
• CVE-2026-25481 Critical 9.4 Langroid has WAF Bypass Leading to RCE in TableChatAgent 0.7%
• CVE-2025-46725 High 8.1 Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store 0.5%
• CVE-2025-46724 Critical 9.8 Langroid has a Code Injection vulnerability in TableChatAgent 0.8%
• CVE-2025-46726 High 7.8 Langroid Vulnerable to XXE Injection via XMLToolMessage 0.7%