Description
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| chatchat-space | Langchain-Chatchat | ≤ 0.3.1.3 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE http/cves/2026/CVE-2026-75128.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- Lasso.security Advisory technical-description exploit
- https://github.com/chatchat-space/Langchain-Chatchat/blob/a6a9193b5002061719f0eee62c6310bd5b1b7f63/libs/chatchat-server/chatchat/server/api_server/tool_routes.py#L33 technical-description
- VulnCheck Advisory: Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint third-party-advisory