Tuesday, June 2, 2026 · 3 of 5

1. Langroid CVE-2026-25879 (CVSS 9.8 Critical): SQLChatAgent RCE via prompt injection

   If agents have DB exec privileges, attackers can achieve RCE. Upgrade to v0.63.0 now.

   Jun 1