Lucene search
+L

7 matches found

PyPA
PyPA
added 2026/07/13 3:46 p.m.30 views

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

SummarySQLChatAgent in langroid ships a validatequery defense-in-depth layerwhose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQLprimitives by specific function name. The list misses the canonicalPostgreSQL filesystem-disclosure family pgreadfile, pgstatfile,pglslogdir, pglswaldir,...

8.7CVSS6.3AI score0.00686EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder