CVE-2026-75128: Langchain-Chatchat lets anyone run shell commands through /tools/call
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint with no authentication, and the built-in shell tool is always registered. One request can run OS commands on the server, as root in the shipped Docker image. No fixed release exists yet.
What it is
The API server's /tools/call route invokes any registered tool by name without checking who is calling. The shell tool is always registered, so naming it in a single request runs arbitrary OS commands as the server user (root in the project's Docker image).
VulnCheck published the advisory on 2026-10-19 and credits Noy Pearl, Michael Sromin and Ophir Dror (Lasso Security). It affects Langchain-Chatchat 0.3.1.3 and earlier, and 0.3.1.3 is still the newest release on PyPI.
Three earlier path traversal CVEs hit the same project's upload code: CVE-2026-51884 (/knowledge_base/upload_temp_docs, 0.3.1), CVE-2026-51883 (the knowledge_base_name parameter, 0.3.0 and 0.3.1) and CVE-2026-51882 (the OpenAI-compatible /v1/files upload, 0.3.0). Each lets an attacker write files outside the intended folder.
How to check
- Affected: langchain-chatchat (PyPI) 0.3.1.3 and earlier, including the Docker image.
- Check whether the Chatchat API server port is reachable from anywhere other than localhost.
How to fix
- There is no patched release yet. Don't expose the Chatchat API server to untrusted networks: bind it to localhost or put it behind a reverse proxy that requires authentication.
- Remove or disable the shell tool if you don't need it, and don't run the container as root.
pip show langchain-chatchat | grep -i version