Langroid vulnerabilities
We track 11 vulnerabilities in Langroid products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on July 10, 2026.
Latest Langroid vulnerabilities
- 9.2 Critical severity
langroid: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The q
- 8.1 High severity
langroid: Failure to Sanitize Special Elements into a Different Plane
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered
- 10.0 Critical severity
langroid: Improper Control of Generation of Code
Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agent
- 9.3 Critical severity
langroid: Improper Limitation of a Pathname to a Restricted Directory
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS
- 7.1 High severity
langroid: Improper Limitation of a Pathname to a Restricted Directory
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir` as the intended working-directory boundary for file operations. However, the tools
- 8.7 High severity
langroid: Improper Limitation of a Pathname to a Restricted Directory
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL prim
- 9.8 Critical severity
langroid: Improper Neutralization of Special Elements used in an SQL Command
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.63.0, SQLChatAgent executes SQL produced by an LLM, which is influenceable by prompt injection. When configured with a database role that has privileges enabling
- 9.6 Critical severity
langroid: Improper Control of Generation of Code
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a bypass to the fix for CVE-2025-46724. TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in langroid/utils/pan
- 9.8 Critical severity
langroid: Improper Control of Generation of Code
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `LanceDocChatAgent` uses pandas eval() through `compute_from_docs()`. As a result, an attacker may be able to make the agent run malicious comman
- 9.8 Critical severity
langroid: Improper Control of Generation of Code
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to
- 9.1 Critical severity
langroid: Improper Restriction of XML External Entity Reference
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging `XMLToolMessage` class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensiti