Description
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
chatchat-space Langchain-Chatchat
Default version status: unaffected
0 to ≤ 0.3.1.3affected
pkg:pypi/langchain-chatchatReferences
- https://www.lasso.security/vulnerability-database/cve-2026-75128 ↗
- https://github.com/chatchat-space/Langchain-Chatchat/blob/a6a9193b5002061719f0eee62c6310bd5b1b7f63/libs/chatchat-server/chatchat/server/api_server/tool_routes.py#L33 ↗
- https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint ↗