CVE-2026-7847: langchain-chatchat Insufficiently Random Values Vulnerability
Summary
CVE-2026-7847: Langchain-Chatchat Uses Insufficiently Random Values. Affects langchain-chatchat versions < 0.3.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langchain-Chatchat is an open-source package designed for building chat applications using advanced language models. It provides functionalities for handling user interactions, file uploads, and API integrations. However, versions up to 0.3.1.3 have been identified to possess a vulnerability in the Uploaded File Handler, which can lead to insufficient randomness in file ID generation, potentially exposing the application to security risks.
Vulnerability Detail
The vulnerability arises from the function _get_file_id located in the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py. This function generates file IDs using insufficiently random values, making it easier for attackers to predict or manipulate these IDs. The attack requires access to the local network and is rated as having high complexity, making exploitation difficult but possible. If exploited, this vulnerability could lead to unauthorized access to uploaded files or other sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional security measures such as validating file uploads and using more secure random value generation methods in your application code. However, the best approach is to update to the latest version of the package.
Conclusion
The langchain-chatchat package has a significant vulnerability (CVE-2026-7847) that affects its file ID generation process. Users are strongly advised to update to a patched version to mitigate potential security risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for langchain-chatchat →
FAQ
CVE-2026-7847 is a vulnerability in the langchain-chatchat package that involves insufficiently random values in file ID generation, potentially leading to security risks.
Versions up to 0.3.1.3 of langchain-chatchat are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing additional security measures such as validating file uploads and using secure random value generation methods.
Vulert is a monitoring tool that uses Pipfile.lock to track and alert users in real-time about open-source vulnerabilities in their software.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain-chatchat.
