{"data":{"id":"71f7def9-3cc5-4b11-9e06-ff6994dc6e59","title":"CVE-2026-7847: A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function…","summary":"CVE-2026-7847 affects chatchat-space Langchain-Chatchat up to 0.3.1.3. The function _get_file_id in libs/chatchat-server/chatchat/server/api_server/openai_routes.py, part of the Uploaded File Handler component, produces insufficiently random values. Exploitation requires access to the local network, has high attack complexity and is described as difficult; a public exploit exists. The project was informed early through an issue report but has not responded.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7847","publishedAt":"2026-05-05T17:17:05.153Z","cveId":"CVE-2026-7847","cweIds":["CWE-310","CWE-330"],"cvssScore":"2.6","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-chatchat@<= 0.3.1.3"],"affectedPackageNames":["langchain-chatchat"],"affectedPackageRefs":["pypi:langchain-chatchat"],"affectedVendors":[],"affectedVendorsRaw":["Langchain-Chatchat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langchain-Chatchat insufficiently random file ID generation","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"adjacent","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00235,"epssCheckedAt":"2026-11-08T00:10:11.504Z","kevDateAdded":null,"advisoryAliases":["GHSA-jv4p-mhmp-69vw"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:51.608Z","patchAvailable":null,"disclosureDate":"2026-05-05T17:17:05.153Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-20"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}