LA
Vendor
langroid
11
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54771 | LA langroid langroid | 8.1 | Jul 9 | Langroid: handle_message() executes user-supplied tool JSON without sender verification |
| CVE-2026-54769 | LA langroid langroid | 10.0 | Jul 9 | Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent |
| CVE-2026-54760 | LA langroid langroid | 9.3 | Jul 9 | Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls |
| CVE-2026-50181 | LA langroid langroid | 7.1 | Jul 9 | Langroid: Path traversal in the file tools allows read/write outside configured current directory |
| CVE-2026-50180 | LA langroid langroid | 8.7 | Jul 9 | Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read |
| CVE-2026-55615 | LA langroid langroid | 9.2 | Jul 9 | Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 |
| CVE-2026-25879 | LA langroid langroid | 9.8 | Jun 1 | Langroid has Prompt to SQL Injection, Leading to RCE |
| CVE-2026-25481 | LA langroid langroid | 9.6 | Feb 4 | Langroid has WAF Bypass Leading to RCE in TableChatAgent |
| CVE-2025-46725 | LA Langroid Langroid | 9.8 | May 20 | Langroid is a Python framework to build large language model (LLM)-powered applications |
| CVE-2025-46724 | LA Langroid Langroid | 9.8 | May 20 | Langroid is a Python framework to build large language model (LLM)-powered applications |
| CVE-2025-46726 | LA Langroid Langroid | 9.1 | May 5 | Langroid is a framework for building large-language-model-powered applications |