7 matches found
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
SummarySQLChatAgent in langroid ships a validatequery defense-in-depth layerwhose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQLprimitives by specific function name. The list misses the canonicalPostgreSQL filesystem-disclosure family pgreadfile, pgstatfile,pglslogdir, pglswaldir,...
8.7CVSS6.3AI score0.00686EPSS
SaveExploits0References6Affected Software1
20