docs: scan #102 — langroid/langroid (132 findings, 0 real, 33rd clean scan)

[elfrost]

Scan #102 of the public series. langroid/langroid — 4.1k★ multi-agent LLM programming framework, MIT, 459 Python files, HEAD 053dbfe.

132 findings, zero real after curation. Thirty-third clean scan. Nothing filed upstream.

Strict-norm target: substantial SECURITY.md, private vulnerability reporting enabled, 16 published advisories. The policy is unusually good — it names its own sanitize_command() and SQL/Cypher denylists as best-effort hardening, not security boundaries, points at the real ones (database role, container, egress), and then enumerates seven in-scope categories. So the scan checked those seven rather than hunting the denylist bypasses the policy already declares out of scope. Seven for seven.

The advertised-boundary test is only worth running because it can come back no — this series has published it failing — so publishing the pass is what makes those readable.

Two methodology notes

A single-idiom taint sweep over-reports on default-deny code. Three prior advisories share one mechanism: relabel USER content as sender=Entity.LLM and the taint filter stops applying. Each advisory blames the handler having no chat_doc parameter. Sweep on that and 16 of 24 handlers look unguarded — including SendTool/AgentSendTool, which are fine. There are three correct taint idioms: doc-derived via chat_doc, the per-tool self._tainted mark, and implicit propagation through the tool_messages list. On default-deny code the false positives look exactly like the two real CVEs. Enumerate the idioms before counting violations.

Cleanest two-install-path split in the series. pip-audit read the pyproject.toml floors and saw nltk 3.10.3 (1 advisory); Trivy read uv.lock and saw nltk 3.10.0 (17). Same package, same scan, both right — averaging them would have destroyed the only signal. The lock governs CI and contributors (uv sync --dev); the Docker image and every PyPI consumer resolve from floors (uv pip install .), so the 83 lockfile advisories touch no shipped artifact.

Three criticals died on reachability, each differently: unstructured's SSRF names partition(url=) and langroid only calls the file-based partitioners; chainlit's RCE needs features.mcp.enabled, which the shipped config leaves off; chromadb is ceiling-pinned <=0.4.23 with no fixed version at all, but both its CVEs describe the ChromaDB server while langroid embeds the client.

Published rather than filed

uv.lock pins gitpython 3.1.56 against CVE-2026-78676, a critical config-injection RCE fixed in 3.1.59 — in a package langroid imports in its own file_tools.py and repo_loader.py. Reachable code, but not in any consumer's environment. There is no .github/dependabot.yml, so nothing is configured to notice. Hygiene, visible to anyone reading the lockfile, not a vulnerability in the shipped library — so it goes in the post, not an issue.

Files

• docs/scans/langroid-langroid.md — new write-up
• docs/index.md — new row, counts 101 → 102
• docs/scan-log.md — new prose entry, count 101 → 102, plus a pre-existing dead link fixed (scans/openai-codex.html → scans/soju06-codex-lb.html), unrelated to this scan

🤖 Generated with Claude Code