Critical Langroid Vulnerability Allows RCE via Prompt Injection

Researchers discovered a critical RCE vulnerability in Langroid's SQLChatAgent that can be exploited via prompt injection to force dangerous database operations (such as PostgreSQL COPY FROM PROGRAM), enabling arbitrary system command execution, data exfiltration, data destruction, and lateral movement; a security patch is available in Langroid v0.63.0 which implements a SELECT-only allowlist and dialect-aware blocklist.