GHSA-gjgq-w2m6-wr5q: Langroid: handle_message() executes user-supplied tool JSON without sender verification

Summary

A Langroid application that exposes a chat interface to untrusted users can have registered tools invoked directly from raw JSON chat input, even when a tool is registered with use=False, handle=True. The tool dispatch path in agent_response() → handle_message() → get_tool_messages() does not check whether the message came from Entity.USER or Entity.LLM. Depending on which handled tools are enabled, impact can include file read/write, database query execution, or access to internal orchestration tools.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langroidPyPILLM dependency since 2023-07-14

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database