CVE-2026-7845
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Langchain-Chatchat up to 0.3.1.3, a vulnerability was found in the function PIL.Image.tobytes of dialogue.py in the Vision Chat Paste Image Handler component. Manipulation of the paste_image.image_data argument leads to use of weak hash. Local network access is required and the attack is difficult.
Risk Assessment
The risk involves the use of a weak hash, which could facilitate attacks on data integrity or authentication.
Recommendation
It is recommended to upgrade Langchain-Chatchat to a newer version that fixes this vulnerability, or apply temporary network security measures.
Original NVD description (English source)
A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. This manipulation of the argument paste_image.image_data causes use of weak hash. The attacker needs to be present on the local network. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.