CVE-2026-75128

Langchain-Chatchat versions through 0.3.1.3 are vulnerable to unauthenticated Remote Code Execution (RCE) due to a missing authentication check on the POST /tools/call API endpoint. This endpoint allows the invocation of any registered tool by name; specifically, the shell tool is always register...