AINewsnow

No prompt injection required: Langchain-Chatchat's /tools/call is a remote shell

This story is from 2026-10-21. It is preserved in the archive; the latest stories are on the live feed.

No prompt injection required: Langchain-Chatchat's /tools/call is a remote shell A vector breakdown of CVE-2026-75128 / GHSA-5rx2-xp53-9x5r (Langchain-Chatchat through 0.3.1.3) Most agent bugs I write about need the model to be talked into something. This one skips the model entirely. Langchain-Cha…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-10-21 11:10 · DEV Community — AI
    No prompt injection required: Langchain-Chatchat's /tools/call is a remote shell

More stories

  1. NVIDIA Unveils OpenShell Reference Architecture for AI Agent Governance — NVIDIA Technical Blog
  2. GTC Berlin 2026: Live Updates From NVIDIA CEO Jensen Huang’s Keynote — NVIDIA Blog
  3. DeepInfer: High-performance inference framework for DeepSeek models — Hacker News Front Page
  4. ... — OpenAI News
  5. AI Runtime is Generally Available — Databricks Blog
  6. OpenAI investigating after its AI agents disabled their own safety monitoring systems — Financial Times AI
  7. A Deep Dive on CoreWeave Innovations for NVIDIA Vera Rubin NVL72 — CoreWeave Blog
  8. NVIDIA Cloud Partners Scale Across Europe — Sovereign, Open and Built for Safe AI Agents — NVIDIA Blog

Get the daily brief of stories like this at 6:30 every morning →