Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)
Langroid's SQLChatAgent lets an AI model write and run SQL against a database on a user's behalf. If an attacker can influence what the model generates — either directly through a prompt or indirectly by planting instructions in data the model later reads — they can make it emit database-specific commands that execute operating system code or read/write arbitrary files on the database server.
How the attack works
An attacker injects instructions into a prompt or into data the agent will later process, steering the LLM to produce SQL containing a dangerous primitive instead of an ordinary query. Depending on the database backend, this is PostgreSQL's COPY ... FROM PROGRAM or pg_execute_server_program, MySQL's LOAD_FILE/INTO OUTFILE/FILE privilege functions, or MSSQL's xp_cmdshell. The SQLChatAgent then executes this LLM-generated SQL verbatim through its query tool, without distinguishing it from a normal SELECT or INSERT. If the configured database role has the necessary privileges, this results in remote code execution or arbitrary file access on the database host.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5e7868ab-c463-4041-8c8f-a75aca160d7f
- Severity
- Critical
- CVEs
- CVE-2026-25879
Why it matters
An attacker can gain code execution or arbitrary file read/write on the database server, potentially leading to full host compromise, data theft, or lateral movement — from what looks like a normal chatbot query.
What you can do
- →Upgrade Langroid to 0.63.0 or later, where this legacy behavior is restricted by default.
- →Do not set allow_dangerous_operations=True unless the deployment is fully trusted and isolated.
- →Run the SQL agent's database role with the minimum privileges needed — remove FILE, xp_cmdshell, and program-execution rights where not required.
- →Treat any data the LLM may read (documents, web content, prior tool output) as untrusted input that could contain injected instructions, and monitor generated SQL for dialect-specific dangerous primitives before execution.
Known benign look-alikes
- A database administrator legitimately running COPY ... FROM PROGRAM or xp_cmdshell through a trusted, human-authored maintenance script — expected to match; review confirms intent.
- Security advisory or PR text quoting the CVE-2026-25879 payload.
- A benign SELECT, INSERT, or UPDATE statement generated by the SQL agent.
- A benign COPY FROM a file path (not PROGRAM).