CVE-2026-7847: Langchain-Chatchat Suffers from Insufficiently Random Values Vulnerability
Summary
CVE-2026-7847: Langchain-Chatchat Uses Insufficiently Random Values. Affects langchain-chatchat versions < 0.3.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Langchain-Chatchat is an open-source package designed for handling chat interactions and file uploads in applications. It provides functionalities for integrating chat features with various backend services, including OpenAI. The package is widely used for its ease of integration and flexibility in managing chat-related tasks. However, versions up to 0.3.1.3 have been found to contain a critical vulnerability that affects the randomness of generated values, which can lead to potential security risks.
Vulnerability Detail
The vulnerability arises from the function _get_file_id located in the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py. This function is responsible for generating unique identifiers for uploaded files. Due to insufficient randomness in the values generated, an attacker with access to the local network can exploit this vulnerability. The complexity of the attack is rated as high, and while the exploit is difficult to execute, it has been made public, increasing the risk of exploitation. The vulnerability is classified under CWE-330, indicating a weakness in the randomness of generated values.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing additional checks or using a more secure method for generating unique identifiers for uploaded files. This can help mitigate the risk until the package is updated. For example, you can use Python's built-in uuid library to generate a unique identifier: 'import uuid; file_id = str(uuid.uuid4())'.
Conclusion
The CVE-2026-7847 vulnerability in Langchain-Chatchat highlights the importance of secure random value generation in software applications. Users are encouraged to update their packages promptly and consider implementing additional security measures to protect against potential exploits.
See every vulnerability recorded for langchain-chatchat →
FAQ
CVE-2026-7847 is a vulnerability in the Langchain-Chatchat package that results from insufficiently random values being generated for file identifiers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main risk is that an attacker could exploit the insufficient randomness to predict or manipulate file identifiers, leading to unauthorized access or data breaches.
Yes, a patch is available in version 0.3.1.4 and later of the Langchain-Chatchat package. Users should upgrade to this version to mitigate the vulnerability.
If immediate updates are not possible, implement a temporary workaround by using a more secure method for generating unique identifiers, such as Python's uuid library.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain-chatchat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
