Chatchat-space vulnerabilities
We track 3 vulnerabilities in Chatchat-space products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Chatchat-space vulnerabilities
- 9.8 Critical severity
Langchain-Chatchat: Missing Authentication for Critical Functionality
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to e
- 8.8 High severity
Langchain-Chatchat: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability, which was classified as critical, has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This issue affects some unknown processing of the file /v1/file. The manipulation of the argument flag leads to path traversal. The exploit has
- 9.8 Critical severity
Langchain-Chatchat: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag lead