Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879) - ATR-2026-01987 (1c4e178e-1070-5405-9d9e-b398170176e3)
Detects CVE-2026-25879 (CWE-89, CWE-94): Langroid's SQLChatAgent executes SQL statements produced by the LLM, which is itself influenceable by prompt injection (including indirectly, via data later returned to the LLM). When the configured database role has code-execution or filesystem privileges, an attacker can coerce the LLM into emitting a dialect-specific dangerous primitive — PostgreSQL COPY ... FROM PROGRAM / pg_execute_server_program, MySQL FILE / LOAD_FILE / INTO OUTFILE, or MSSQL xp_cmdshell — which the agent then executes verbatim via RunQueryTool, achieving remote code execution or arbitrary file read/write on the database host. Affected: langroid before 0.63.0 (allow_dangerous_operations=True restores the unrestricted legacy behavior for trusted deployments).
Detection covers: (a) LLM-generated SQL containing PostgreSQL COPY ... FROM PROGRAM or
pg_execute_server_program;
(b) MySQL LOAD_FILE / INTO OUTFILE / FILE-privilege file primitives; (c) MSSQL xp_cmdshell invocation; (d) explicit CVE-2026-25879 exploitation framing.
The detection target is the dialect-specific RCE/filesystem primitive appearing in SQL that is about to be executed by the SQL agent — an ordinary SELECT/INSERT/UPDATE statement, or a benign COPY FROM a file path (not PROGRAM), does not fire.