Langchain-Chatchat: Unauthenticated remote code execution via /tools/call
Summary
Langchain-Chatchat through version 0.3.1.3 exposes a POST /tools/call API endpoint without authentication. The endpoint invokes any registered tool by name, including the always-registered shell tool, which ignores the per-tool allow flag. A remote attacker who can reach the API port can send one HTTP request to run arbitrary operating system commands as the server user, which is root in the shipped Docker image, and access the database, knowledge base files and model API keys.
Affected
- Langchain-Chatchat 0.3.1.3 and all earlier versions (0 to <= 0.3.1.3)
- Shipped Docker image chatimage/chatchat:0.3.1.3-93e2c87-20240829
Fixed in
Unknown. No fixed version has been published at the time of writing.
Workaround
- Require authentication in front of the API, at minimum on /tools/call
- Place the API behind an authenticating reverse proxy and deny /tools and /tools/call unless needed
- Restrict network access with firewall rules and a segmented VLAN
- Do not run the container as root; use a non-root user inside the container
- Monitor the host for unexpected process spawns from the application user
Exploitation
- Publicly documented; upstream issues #5483 and #5515 describe the unauthenticated shell path
- Public exploit code: none found
- Known exploitation in the wild: none found
- CISA SSVC: exploitation status poc, automatable yes, technical impact total
Our recommendation
- Find all Langchain-Chatchat instances, including developer and test systems, and record their versions
- Take exposed instances off the internet immediately or place them behind authentication
- Restrict access to /tools and /tools/call at the proxy or firewall
- Check logs for unexpected requests to /tools/call and unexpected processes in the container
- Track the vendor's GitHub security advisory for a fix, then update and retest
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Lasso vulnerability database entry www.lasso.security
- Vulnerable code in tool_routes.py github.com
- Upstream issue #5483 github.com
- Upstream issue #5515 github.com
- The Hacker Wire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:10.
Original description (NVD)
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.