{"action":"Upgrade langroid to 0.64.0 or later.","affected":[{"fixed":"0.64.0","introduced":"0"}],"component":"langroid","cve_ids":["CVE-2026-50180"],"ecosystem":"PyPI","epss":0.00686,"exploited":false,"fixed_versions":["0.64.0"],"ghsa_id":"GHSA-pmch-g965-grmr","id":"tcs_01M5KFTB1V3EGD53NNC4JY7XWB","modified_at":"2026-07-13T16:43:13.962169214Z","published_at":"2026-07-02T17:42:09Z","references":["https://osv.dev/vulnerability/GHSA-pmch-g965-grmr","https://github.com/langroid/langroid/security/advisories/GHSA-pmch-g965-grmr","https://github.com/langroid/langroid/commit/00b7dd7b79c5d03c94be284cf3459d98195ebfba","https://github.com/langroid/langroid"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-pmch-g965-grmr","url":"https://osv.dev/vulnerability/GHSA-pmch-g965-grmr"},{"source":"nvd","source_id":"CVE-2026-50180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50180"}],"summary":"Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read"}