LangChain's SQLDatabaseChain let a prompt inject arbitrary SQL into the connected database

Undisclosed·LangChain SQLDatabaseChainFixed

SQLDatabaseChain took a user's natural-language request, had the LLM turn it into SQL, and executed that SQL directly against the connected database with no review step; a prompt such as 'Drop the employee table' caused the chain to generate and run a DROP TABLE statement, and researchers showed the same path could be used to execute arbitrary SQL/code against the database service.

Blast radius

Any application built on LangChain's SQLDatabaseChain before version 0.0.247 could have its database tables altered or destroyed by a single crafted prompt; the issue was rated CVSS 3.1 9.8 (critical) with high confidentiality, integrity and availability impact. No specific victim organization, dataset loss, or dollar figure is disclosed in the advisory or the originating GitHub issue.

Root cause

The chain fed LLM-generated SQL straight to the database connection with no sanitisation, allow-listing, read-only credentials, or human-in-the-loop check, so any prompt injection reachable by an end user became executable SQL.

How it was caught

Not caught internally — a developer (Asim Jalis) publicly reported it on GitHub on 2023-06-09 with a reproducible proof-of-concept that dropped a table in the example Chinook database; it was later assigned CVE-2023-32785 and published as GHSA-8h5w-f6q9-wg35 on 2023-10-21.

What changed

LangChain shipped a patched release, version 0.0.247, per the GitHub Security Advisory; the advisory does not detail the specific code change beyond marking that version as the fix.

Take-awayNever let an LLM-generated SQL/command string execute directly against a live database — use a read-only or least-privilege DB user, an allow-list/query checker, or a human approval step between the model's output and execution.