Loading story…
Researchers disclosed CVE-2026-25879, a critical vulnerability in the Langroid Python framework that lets attackers use prompt injection to steer the SQLChatAgent component into executing malicious LLM-generated SQL. The flaw can bypass intended input restrictions and abuse database-specific primitives, potentially escalating from SQL manipulation to remote code execution on the database host. Reported impacts include arbitrary command execution, data exfiltration, destructive database changes, and possible lateral movement, and the issue was rated CVSS 9.8.
The exposure affects Langroid versions prior to 0.63.0 and is most severe when the application connects with highly privileged database roles, including capabilities such as PostgreSQL pg_execute_server_program, MySQL FILE, or MSSQL xp_cmdshell. Researchers also warned that exploitation may occur through indirect attacker influence over data returned to the LLM, not only through direct user prompts. Langroid patched the issue in version 0.63.0 by enforcing a strict SELECT-only allowlist parsed with sqlglot and adding a dialect-aware blocklist for dangerous patterns, while still permitting trusted deployments to restore broader behavior with allow_dangerous_operations=True.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Langroid patched the vulnerability in version 0.63.0 by making SQLChatAgent default to a strict SELECT-only allowlist parsed with sqlglot and adding a dialect-aware blocklist for dangerous patterns. The prior unrestricted behavior can still be re-enabled in trusted deployments with allow_dangerous_operations=True.
Researchers from Carnegie Mellon University and the University of Wisconsin–Madison discovered a critical prompt-injection flaw in Langroid's SQLChatAgent that could lead to remote code execution on the database host when dangerous database privileges were available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Langroid fixed **CVE-2026-55615** in `Neo4jChatAgent`, where LLM-generated Cypher queries were sent to Neo4j without validation before version `0.65.5`. Because the query text could be influenced by direct user prompts or indirectly through retrieved RAG content, an attacker could abuse prompt-to-Cypher injection to read, modify, or destroy graph data. In Neo4j deployments with dangerous procedures enabled, including **APOC** or `dbms.security` features, the flaw could also expose the filesystem and enable operating system command execution. A related Langroid patch also addressed the same defect pattern in `ArangoChatAgent`, where unvalidated AQL could be passed to the database driver. The remediation introduced a default-off `allow_dangerous_operations` control and validator functions that enforce read-only behavior on retrieval paths while blocking risky primitives such as Neo4j `CALL db.*`, `LOAD CSV`, APOC and `dbms` procedures, and ArangoDB `namespace::func` UDF calls unless explicitly enabled by an operator. The fix was described as mirroring the earlier `SQLChatAgent` bug tracked as **CVE-2026-25879**, and the project added 76 static unit tests to cover attack vectors, enforcement, bypass attempts, and false-positive handling.
Jul 11, 2026
Check Point Research disclosed three vulnerabilities in LangGraph’s persistence layer affecting self-hosted deployments that use SQLite or Redis checkpointers and expose `get_state_history()` with a user-controlled filter. The most severe attack chain combines a SQL injection flaw in the SQLite checkpointer, tracked as **CVE-2025-67644**, with unsafe `msgpack` deserialization, tracked as **CVE-2026-28277**, allowing an attacker to insert a malicious checkpoint row that is later deserialized into remote code execution. Researchers also identified a SQL injection issue in the Redis checkpointer, **CVE-2026-27022**, along with additional defense-in-depth SQL injection concerns in SQLite and PostgreSQL query construction. LangChain released patches and urged users to upgrade to **`langgraph-checkpoint-sqlite` 3.0.1 or later**, **`langgraph` 1.0.10 or later**, and **`langgraph-checkpoint-redis` 1.0.2 or later**. The exposed-risk scenario described in the report applies to self-hosted environments with vulnerable checkpointer configurations, while LangSmith Deployment was reported as unaffected by the primary attack path because it uses PostgreSQL rather than the impacted SQLite or Redis setups.
Jun 29, 2026
A critical vulnerability in the LangChain-based no-code LLM development platform **Langflow** exposed internet-facing instances to unauthenticated remote code execution. Tracked as **`CVE-2025-3248`** and rated **CVSS 9.8**, the flaw was disclosed after researchers showed that unsafe use of Python `exec` could be abused through Langflow's code-validation functionality, allowing attackers to run arbitrary Python on vulnerable servers. Security monitoring by MBSD-SOC found exploitation attempts beginning on **April 10, 2025**, shortly after public disclosure on April 8. Attackers were observed sending crafted `POST` requests to the **`/api/v1/validate/code`** endpoint to execute malicious Python, including attempts to read sensitive files such as **`/etc/passwd`**. The report said proof-of-concept code and real-world abuse were already circulating, and urged organizations to update Langflow immediately; telemetry cited the **Netherlands** and **France** as the source of roughly half of observed attack traffic.
Aug 15, 2026