Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/07/02 5:42 p.m.13 views

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Summary SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pgreadfile, pgstatfile, pglslogdir,...

8.7CVSS6.1AI score0.00568EPSS
SaveExploits0References3Affected Software1
Rows per page
Query Builder