CVE-2026-30617: LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execut

LangChain-ChatChat version 0.3.1 has a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in how it handles MCP STDIO servers (a communication protocol for server connections). An attacker can access the exposed management interface, set up a malicious MCP server with commands of their choice, and then trigger those commands to run when the service processes agent requests.