{"action":"Upgrade langroid to 0.64.0 or later.","affected":[{"fixed":"0.64.0","introduced":"0"}],"component":"langroid","cve_ids":["CVE-2026-50180"],"ecosystem":"PyPI","epss":0.00686,"exploited":false,"fixed_versions":["0.64.0"],"ghsa_id":"GHSA-pmch-g965-grmr","id":"tcs_01M5KH0AK3GSTB2GV4DCH6ERE2","modified_at":"2026-07-13T16:31:49.875978863Z","published_at":"2026-07-13T15:46:27.143049Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2580","https://github.com/langroid/langroid/security/advisories/GHSA-pmch-g965-grmr","https://github.com/langroid/langroid/commit/00b7dd7b79c5d03c94be284cf3459d98195ebfba","https://github.com/langroid/langroid","https://pypi.org/project/langroid","https://github.com/advisories/GHSA-pmch-g965-grmr","https://nvd.nist.gov/vuln/detail/CVE-2026-50180"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-2580","url":"https://osv.dev/vulnerability/PYSEC-2026-2580"}],"summary":"Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read"}