LowVulnerability
CVE-2026-7845: Langchain-Chatchat weak hash in Vision Chat paste image handler
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-7845
- Published
- Record updated
- Affected
- langchain-chatchat <= 0.3.1.3
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.1%
Summary
CVE-2026-7845 affects chatchat-space Langchain-Chatchat up to 0.3.1.3. A flaw in the Vision Chat Paste Image Handler, in the function PIL.Image.tobytes within libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py, is triggered by manipulating the argument paste_image.image_data, which causes use of a weak hash. An attacker must be on the local network, and the attack has high complexity and difficult exploitability. A published exploit may be used, and the project has not responded to an early issue report.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database