CVE-2026-75128

EUVD-2026-104685
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.42%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
chatchat-spacelangchain-chatchat
𝑥
≤ 0.3.1.3
CNA
Common Weakness Enumeration
References
https://github.com/chatchat-space/Langchain-Chatchat/blob/a6a9193b5002061719f0eee62c6310bd5b1b7f63/libs/chatchat-server/chatchat/server/api_server/tool_routes.py#L33
https://www.lasso.security/vulnerability-database/cve-2026-75128
https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint