CVE-2026-7845lowCWE-327CWE-328

CVE-2026-7845: falha de baixa gravidade em chatchat-space Langchain-Chatchat

chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hash

Publicada em

Seguir esta CVE+ Monitorar Langchain-Chatchat+ Monitorar langchain-chatchat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 2.1epss 0.1%
A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. This manipulation of the argument paste_image.image_data causes use of weak hash. The attacker needs to be present on the local network. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
chatchat-space · Langchain-Chatchat
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — chatchat-space Langchain-Chatchat

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75128CRITICALLangchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call EndpointEPSS 2.2%CVE-2025-6853MEDIUMchatchat-space Langchain-Chatchat Backend upload_temp_docs path traversalEPSS 0.6%CVE-2025-6855MEDIUMchatchat-space Langchain-Chatchat file path traversalEPSS 0.6%CVE-2025-6854MEDIUMchatchat-space Langchain-Chatchat files path traversalEPSS 0.6%CVE-2026-7844MEDIUMchatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authenticationEPSS 0.3%CVE-2026-7847LOWchatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random valuesEPSS 0.2%