Langroid Framework Vulnerability in Chat Interface Exposes Tool Invocations
CVE-2026-54771

8.1HIGH

Key Information:

Vendor

Langroid

Status
Langroid
Vendor
CVE Published:
9 July 2026

What is CVE-2026-54771?

Prior to version 0.65.3, the Langroid framework allowed applications with chat interfaces exposed to untrusted users to invoke tools directly via raw JSON payloads. This occurred even when tools were configured to prevent usage with use=False and were only meant to be handled with handle=True. This vulnerability creates an opportunity for attackers to leverage tool functionalities without appropriate authorization, compromising the application's integrity and security.

Affected Version(s)

langroid < 0.65.3

References

https://github.com/langroid/langroid/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.