chatchat-space Langchain-Chatchat up to 0.3.1.3 Vision Chat Paste Image dialogue.py PIL.Image.tobytes paste_image.image_data weak hash

Summaryinfo

A vulnerability categorized as problematic has been discovered in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. Such manipulation of the argument paste_image.image_data leads to weak hash. This vulnerability is traded as CVE-2026-7845. Access to the local network is required for this attack to succeed. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. It has been rated as problematic. Affected by this issue is the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. The manipulation of the argument paste_image.image_data with an unknown input leads to a weak hash vulnerability. Using CWE to declare the problem leads to CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). Impacted is integrity.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-7845. The exploitation is known to be difficult. The attack can only be done within the local network. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1600.001.

The exploit is available at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27390). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Vendor

• chatchat-space

Name

• Langchain-Chatchat

Version

• 0.3.1.0
• 0.3.1.1
• 0.3.1.2
• 0.3.1.3

Website

• Product: https://github.com/chatchat-space/Langchain-Chatchat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #807794: chatchat-space Langchain-Chatchat 0.3.1.3 Weak Hash / CWE-328 (by Dem00)

Once again VulDB remains the best source for vulnerability data.

Discussion