Disclosed weakness · no CVE recorded

Langroid’s SELECT-only SQL agent permits SQLite file reads and writes

Langroid · SQLChatAgent with SQLite fileio functions

First documented disclosure · Review checkpoint

Summary

An agent constrained to SELECT queries can still read or write files when SQLite provides file I/O functions.

Severity and exploitation evidence

High · 7.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The researcher reproduced file access in a local fixture. The advisory reports no production testing or malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The SQL validator omitted readfile() and writefile(). Calling either inside a permitted SELECT invokes a filesystem operation in the database process.

Conditions required

The attacker can influence SQLChatAgent queries, the SQLite environment exposes the relevant functions, and the process can access the target files.

Potential impact

Reading local files or writing attacker-chosen contents with the database process’s permissions.

Affected versions and configurations

0.69.18 was reproduced in a local fixture. The advisory lists releases through 0.69.18.

Fix and mitigation status

0.69.19 blocks the affected file operations in the parsed query.

Practical next steps

Upgrade to a release containing the 0.69.19 fix and remove unnecessary file I/O functions from the database environment.

Operating lesson

Constrain the functions a query can call as well as its statement type.

Evidence and limits

The advisory and fixed release appeared November 3. GHSA-vqhw-xhff-464q lists no CVE. File I/O availability depends on the SQLite build and extensions.

Sources