Live › vulnerability › CVE-2026-75128
Go to dashboardLangchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint that runs any registered tool by name with no authentication. Because the shell tool is always registered, a remote attacker can send one request to execute arbitrary OS commands as the server user, which is root in the shipped Docker image.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| langchain-chatchat | pypi | <= 0.3.1.3 | – |
pip show langchain-chatchat (or check the Docker image tag, e.g. chatimage/chatchat:0.3.1.2-2024-0720)0.3.1.3 is affectedcurl -s http://HOST:7861/toolsshell tool, you are exposed0.3.1.3)0.0.0.0 bindingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
This page as .md · .json · in your agent: get_signal("CVE-2026-75128")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.