CVE-2026-7845: langchain-chatchat Vulnerability Due to Weak Cryptographic Algorithm
Summary
CVE-2026-7845: Langchain-Chatchat Uses a Broken or Risky Cryptographic Algorithm. Affects langchain-chatchat versions < 0.3.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Langchain-Chatchat is a Python package available on PyPI that facilitates vision chat functionalities, allowing users to interact with images and text in a conversational manner. It is designed to enhance user experience by integrating image handling capabilities within chat interfaces. However, the package has been found to have a significant vulnerability that compromises its security, particularly in the handling of image data.
Vulnerability Detail
A flaw has been identified in the Langchain-Chatchat package up to version 0.3.1.3, specifically within the function PIL.Image.tobytes in the dialogue.py file. This vulnerability arises from the use of a weak hash algorithm when processing image data, which can be exploited by an attacker present on the local network. The complexity of the attack is high, and while the exploit has been published, its successful execution is considered difficult. The implications of this vulnerability include potential unauthorized access to sensitive image data and the risk of data integrity issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider restricting access to the application from untrusted networks to minimize the risk of exploitation. Additionally, monitor network traffic for any suspicious activity related to image data handling.
Conclusion
The langchain-chatchat package has a critical vulnerability due to the use of a weak cryptographic algorithm in handling image data. Users are strongly advised to update to a patched version to mitigate risks. Additionally, implementing temporary workarounds can help reduce exposure until an update is feasible.
See every vulnerability recorded for langchain-chatchat →
FAQ
CVE-2026-7845 is a vulnerability in the langchain-chatchat package that involves the use of a weak cryptographic algorithm for image data processing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include potential unauthorized access to sensitive image data and the possibility of data integrity issues due to weak hashing.
If immediate updates are not possible, restrict access to the application from untrusted networks and monitor for suspicious activity.
You can visit Vulert at https://vulert.com, which monitors and alerts for open-source vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain-chatchat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
