CVE-2026-75128criticalCWE-306

CVE-2026-75128: falha crítica em chatchat-space Langchain-Chatchat

Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint

Publicada em

Seguir esta CVE+ Monitorar Langchain-Chatchat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

63Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 9.3epss 2.2%
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
chatchat-space · Langchain-Chatchat
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — chatchat-space Langchain-Chatchat

No mesmo produto, das mais perigosas para as menos.

CVE-2025-6853MEDIUMchatchat-space Langchain-Chatchat Backend upload_temp_docs path traversalEPSS 0.6%CVE-2025-6855MEDIUMchatchat-space Langchain-Chatchat file path traversalEPSS 0.6%CVE-2025-6854MEDIUMchatchat-space Langchain-Chatchat files path traversalEPSS 0.6%CVE-2026-7844MEDIUMchatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authenticationEPSS 0.3%CVE-2026-7847LOWchatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random valuesEPSS 0.2%CVE-2026-7846LOWchatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouEPSS 0.2%