Unauthenticated Remote Code Execution in Langchain-Chatchat

Langchain-Chatchat versions through 0.3.1.3 contain a critical remote code execution vulnerability (CVE-2026-75128) resulting from improper access control on the application API. The POST /tools/call endpoint allows any remote attacker to invoke registered system tools by name without prior authentication. Because the application includes a shell execution tool among its default registered assets, an attacker can leverage this endpoint to execute arbitrary OS commands. In the standard Docker deployment configuration, this command execution occurs with root privileges, leading to full system compromise. This vulnerability is highly dangerous due to the absence of authentication requirements and the direct path to command execution.

Attack Chain

1. Attacker identifies a target host running Langchain-Chatchat (<= 0.3.1.3) exposed to the internet.
2. Attacker performs discovery to identify the API structure, locating the /tools/call endpoint.
3. Attacker sends a crafted HTTP POST request to the /tools/call endpoint.
4. The request payload specifies the 'shell' tool as the target for execution.
5. The application processes the request without validating the user session or permissions.
6. The shell tool executes the attacker-supplied command string on the underlying host.
7. The application returns the output of the command to the attacker.
8. Attacker achieves full system control as the application user (typically root).

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the host server. Given the application is frequently deployed in containerized environments, this typically grants the attacker full root access to the container or host filesystem, enabling data exfiltration, lateral movement, or complete system takeover.

Recommendation

• Immediately restrict network access to the Langchain-Chatchat API endpoint, ensuring it is not reachable from untrusted networks or the public internet.
• Monitor web server logs for POST requests directed at /tools/call, especially those containing references to shell-related utilities in the request body.
• Apply the vendor-provided security patch once available; verify versioning for releases exceeding 0.3.1.3.
• Audit all containerized deployments to ensure the application process is running with the least privilege necessary, rather than the default root user.