{"data":{"id":"a3831039-632e-4381-b4df-2447a580ea46","title":"CVE-2026-7845: A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function…","summary":"CVE-2026-7845 affects chatchat-space Langchain-Chatchat up to 0.3.1.3. A flaw in the Vision Chat Paste Image Handler, in the function PIL.Image.tobytes within libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py, is triggered by manipulating the argument paste_image.image_data, which causes use of a weak hash. An attacker must be on the local network, and the attack has high complexity and difficult exploitability. A published exploit may be used, and the project has not responded to an early issue report.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7845","publishedAt":"2026-05-05T16:16:19.383Z","cveId":"CVE-2026-7845","cweIds":["CWE-327","CWE-328"],"cvssScore":"2.6","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-chatchat@<= 0.3.1.3"],"affectedPackageNames":["langchain-chatchat"],"affectedPackageRefs":["pypi:langchain-chatchat"],"affectedVendors":[],"affectedVendorsRaw":["Langchain-Chatchat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langchain-Chatchat weak hash in Vision Chat paste image handler","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"adjacent","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0014,"epssCheckedAt":"2026-11-08T06:09:28.210Z","kevDateAdded":null,"advisoryAliases":["GHSA-wmvv-fhm6-w34x"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:52.651Z","patchAvailable":null,"disclosureDate":"2026-05-05T16:16:19.383Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-20"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}