Langchain-Chatchat CVE-2026-75128

No special conditions - remote unauthenticated exploitation against default deployments of Langchain-Chatchat (through 0.3.1.3), because the /tools/call endpoint requires no authentication and the shell tool is always registered and callable by name. The only practical prerequisites are network reachability of the Chatchat API server and the affected version range; no user interaction, credentials, or non-default configuration is needed. Impact is amplified in the shipped Docker image, where the server runs as root, so commands execute with root privileges rather than a limited account.

This is a genuine high-priority issue, not an inflated CVSS score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) aligns cleanly with the description: a network-reachable POST /tools/call endpoint invokes any registered tool without authentication (CWE-306), and the always-registered shell tool yields arbitrary OS command execution. All three impact dimensions (confidentiality, integrity, availability) are High, and the shipped Docker image runs as root, so successful exploitation means full host compromise rather than a constrained service account. Publicly available exploit code exists (per the Lasso Security reference tagged as exploit and the VulnCheck advisory), which materially raises near-term risk. The vulnerability is NOT in CISA KEV at time of analysis and no EPSS score was provided, so there is no evidence of confirmed active exploitation or a quantified exploitation probability - the elevated risk here is driven by low attack complexity, no authentication, and public POC availability rather than observed in-the-wild activity. The signals are consistent with no major conflicts; the main caveat is that KEV and EPSS data are simply absent from the input, so widespread-vs-targeted exploitation cannot be judged from the data provided.

A remote attacker locates an internet-exposed or network-reachable Langchain-Chatchat instance (through 0.3.1.3) and sends a single unauthenticated POST request to /tools/call naming the always-registered shell tool with an OS command payload. The server executes the command as its runtime user - root in the shipped Docker image - giving the attacker immediate arbitrary command execution. Public exploit code exists, and the low attack complexity (AC:L, no user interaction, no authentication) makes this trivially repeatable.