AIKIDO-2026-939441
langroid is vulnerable to Improper Authorization
81
High Risk
This Affects:
langroidTL;DR
RecipientTool and AddRecipientTool re-emit their untrusted content as a new ChatDocument labeled as coming from the LLM, which clears the taint flag that marks user-origin messages. Because the re-emitted document is treated as trusted, embedded tool calls survive the filter that normally blocks untrusted input from invoking handle-only tools. This lets untrusted chat content trigger tools such as file read and write, SQL execution, and internal orchestration that were never meant to be reachable from user input. The fix propagates the originating message taint into the re-emitted document so laundered content stays blocked.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable RecipientTool or AddRecipientTool routing while also registering handle-only tools reachable through untrusted chat input.
Background info
langroid is vulnerable to Improper Authorization in versions 0.0.1 - 0.65.10.
How to fix this
Upgrade the langroid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant