{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/langroid--0.65.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["langroid (\u003c= 0.65.2)"],"_cs_severities":["high"],"_cs_tags":["langroid","vulnerability","rce","logic-error","python"],"_cs_type":"advisory","_cs_vendors":["Langroid"],"content_html":"\u003cp\u003eA critical logic flaw (CVE-2026-54771) has been identified in Langroid applications, affecting versions up to and including 0.65.2. This vulnerability allows untrusted users interacting with a chat interface to directly invoke internal application tools by supplying raw JSON payloads. The \u003ccode\u003ehandle_message()\u003c/code\u003e function within the \u003ccode\u003eChatAgent\u003c/code\u003e lacks proper sender verification, permitting tools registered with \u003ccode\u003euse=False, handle=True\u003c/code\u003e to be executed, which developers might mistakenly believe are protected from direct user invocation. This bypass of intended security controls can lead to unauthorized actions such as file system manipulation, database command execution, or control over internal orchestration tools, posing a significant risk of remote code execution or sensitive data compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, as an untrusted user, interacts with a vulnerable Langroid chat application.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious chat message containing a raw JSON payload designed to invoke a specific internal tool, for example, \u003ccode\u003e{\u0026quot;request\u0026quot;:\u0026quot;secret_tool\u0026quot;,\u0026quot;value\u0026quot;:\u0026quot;pwned\u0026quot;}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Langroid \u003ccode\u003eChatAgent\u003c/code\u003e receives the user's message as input.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eagent.handle_message()\u003c/code\u003e function is called to process the user's input.\u003c/li\u003e\n\u003cli\u003eInside \u003ccode\u003ehandle_message()\u003c/code\u003e, the \u003ccode\u003eget_tool_messages()\u003c/code\u003e method parses the raw JSON from the user message, identifying it as a valid \u003ccode\u003eToolMessage\u003c/code\u003e invocation.\u003c/li\u003e\n\u003cli\u003eDespite the tool (e.g., \u003ccode\u003eSecretTool\u003c/code\u003e) being configured with \u003ccode\u003euse=False, handle=True\u003c/code\u003e, indicating it should not be directly generated by the LLM or exposed to end-users, its \u003ccode\u003ehandle()\u003c/code\u003e method is directly executed.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehandle()\u003c/code\u003e method performs its intended action, which, depending on the tool, could include reading/writing files, executing database queries, or interacting with internal systems.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully bypasses security mechanisms to achieve unauthorized execution of internal tools, potentially leading to remote code execution or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of CVE-2026-54771 can be severe, leading to significant compromise of affected systems. Depending on the specific internal tools enabled within the Langroid application, attackers could achieve capabilities such as arbitrary file read and write, direct execution of database queries, or unauthorized access to and manipulation of internal orchestration systems. This could result in sensitive data exfiltration, system defacement, denial of service, or full remote code execution, undermining the integrity, confidentiality, and availability of the application and underlying infrastructure. Developers may have registered these tools with the belief that \u003ccode\u003euse=False\u003c/code\u003e provides sufficient protection, making this vulnerability particularly insidious.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch Langroid applications to a version greater than 0.65.2 to address CVE-2026-54771.\u003c/li\u003e\n\u003cli\u003eReview all \u003ccode\u003eenable_message\u003c/code\u003e configurations within your Langroid applications, especially for sensitive tools, to ensure that only trusted entities can invoke them.\u003c/li\u003e\n\u003cli\u003eImplement robust input validation and sanitization at the application boundary for all user-supplied chat inputs to prevent raw JSON tool payloads from reaching the \u003ccode\u003ehandle_message()\u003c/code\u003e function.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-06T20:45:48Z","date_published":"2026-07-06T20:45:48Z","id":"https://feed.craftedsignal.io/briefs/2026-07-langroid-tool-invocation-bypass/","summary":"A high-severity vulnerability, CVE-2026-54771, in Langroid applications allows untrusted users to directly invoke internal tools via raw JSON payloads, even when these tools are configured not to be used by the LLM, enabling malicious actors to bypass security controls and execute sensitive operations like file read/write, database queries, or access to internal orchestration tools.","title":"Langroid Tool Invocation Bypass via Unverified User Messages (CVE-2026-54771)","url":"https://feed.craftedsignal.io/briefs/2026-07-langroid-tool-invocation-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Langroid (\u003c= 0.65.2)","version":"https://jsonfeed.org/version/1.1"}