langchain-chatchat vulnerabilities
CVEs whose affected-version data names the langchain-chatchat package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-75128Critical· 9.8PoCLangchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request nam…
CVE-2026-7846Low· 2.6Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API
Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API
CVE-2026-7845Low· 2.6Langchain-Chatchat Uses a Broken or Risky Cryptographic Algorithm
Langchain-Chatchat Uses a Broken or Risky Cryptographic Algorithm
CVE-2026-7847Low· 2.6Langchain-Chatchat Uses Insufficiently Random Values
Langchain-Chatchat Uses Insufficiently Random Values
CVE-2025-6853Medium· 6.3Langchain-Chatchat has a Path Traversal vulnerability
Langchain-Chatchat has a Path Traversal vulnerability
CVE-2025-6855Medium· 5.5Langchain-Chatchat vulnerable to path traversal
Langchain-Chatchat vulnerable to path traversal
CVE-2025-6854Medium· 4.3Langchain-Chatchat vulnerable to path traversal
Langchain-Chatchat vulnerable to path traversal