# Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)

- **Severity:** Critical
- **Signature ID:** `5e7868ab-c463-4041-8c8f-a75aca160d7f`
- **CVEs:** CVE-2026-25879
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM01 (Prompt Injection)

## Summary

Langroid's SQLChatAgent lets an AI model write and run SQL against a database on a user's behalf. If an attacker can influence what the model generates — either directly through a prompt or indirectly by planting instructions in data the model later reads — they can make it emit database-specific commands that execute operating system code or read/write arbitrary files on the database server.

## How the attack works

An attacker injects instructions into a prompt or into data the agent will later process, steering the LLM to produce SQL containing a dangerous primitive instead of an ordinary query. Depending on the database backend, this is PostgreSQL's COPY ... FROM PROGRAM or pg_execute_server_program, MySQL's LOAD_FILE/INTO OUTFILE/FILE privilege functions, or MSSQL's xp_cmdshell. The SQLChatAgent then executes this LLM-generated SQL verbatim through its query tool, without distinguishing it from a normal SELECT or INSERT. If the configured database role has the necessary privileges, this results in remote code execution or arbitrary file access on the database host.

## Why it matters

An attacker can gain code execution or arbitrary file read/write on the database server, potentially leading to full host compromise, data theft, or lateral movement — from what looks like a normal chatbot query.

## What you can do

- Upgrade Langroid to 0.63.0 or later, where this legacy behavior is restricted by default.
- Do not set allow_dangerous_operations=True unless the deployment is fully trusted and isolated.
- Run the SQL agent's database role with the minimum privileges needed — remove FILE, xp_cmdshell, and program-execution rights where not required.
- Treat any data the LLM may read (documents, web content, prior tool output) as untrusted input that could contain injected instructions, and monitor generated SQL for dialect-specific dangerous primitives before execution.

## Known benign look-alikes

- A database administrator legitimately running COPY ... FROM PROGRAM or xp_cmdshell through a trusted, human-authored maintenance script — expected to match; review confirms intent.
- Security advisory or PR text quoting the CVE-2026-25879 payload.
- A benign SELECT, INSERT, or UPDATE statement generated by the SQL agent.
- A benign COPY FROM a file path (not PROGRAM).

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01987
- https://nvd.nist.gov/vuln/detail/CVE-2026-25879

---
Source: https://www.netzilo.com/threats/atr-langroid-sqlchatagent-prompt-to-sql-remote-code-execution-cv