The SQLChatAgent in langroid uses a regex-based blocklist (_DANGEROUS_SQL_PATTERNS) to prevent dangerous SQL operations by blocking specific function names. However, this blocklist omits several PostgreSQL filesystem-disclosure functions such as pg_read_file(), pg_stat_file(), pg_ls_logdir(), pg_ls_waldir(), and pg_current_logfile(), which return file contents or directory listings. These functions are callable via SELECT statements, which pass the agent's statement-type allowlist and evade the regex blocklist, reaching the SQLAlchemy execution engine. Consequently, an attacker able to influence the LLM's generated SQL query string can read arbitrary files on the PostgreSQL host without needing database credentials. Similar gaps exist for SQLite's ATTACH without the DATABASE keyword and SQL Server's OPENDATASOURCE. The affected versions are langroid <= 0.63.0. No patch or official fix is currently available.

An attacker who can influence the SQL queries generated by the LLM in langroid's SQLChatAgent can read arbitrary files from the PostgreSQL host filesystem. This can lead to unauthorized disclosure of sensitive data stored on the database server. The attack requires no direct database credentials from the attacker, as the agent holds them. The vulnerability bypasses existing query type restrictions and regex-based blocklists, making it a high-severity information disclosure risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or sanitize inputs that influence the LLM-generated SQL queries to prevent injection of dangerous function calls. Consider disabling or limiting the use of SQLChatAgent features that allow arbitrary query execution, or deploy additional query validation layers that explicitly block the missing PostgreSQL functions (e.g., pg_read_file, pg_stat_file, pg_ls_logdir, pg_ls_waldir, pg_current_logfile).