CVE-2026-50180

Affected versions of the `langroid` package are vulnerable to Arbitrary File Read due to an incomplete blocklist in the `_validate_query` method. The `_DANGEROUS_SQL_PATTERNS` regex blocklist fails to include the PostgreSQL filesystem-disclosure functions such as `pg_read_file()`, `pg_stat_file()`, and others, allowing them to bypass security checks. An attacker can exploit this vulnerability by crafting SQL queries that include these functions, enabling them to read arbitrary files from the PostgreSQL host, potentially exposing sensitive information.