CVE-2026-30617
Received Received - Intake

Remote Code Execution in LangChain-ChatChat MCP STDIO Server

Publication date: 2026-04-15

Last updated on: 2026-04-15

Assigner: MITRE

Description
LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and arguments. When the MCP server is started and MCP is enabled for agent execution, subsequent agent activity triggers execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the LangChain-ChatChat service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-15
Last Modified
2026-04-15
Generated
2026-07-06
AI Q&A
2026-04-15
EPSS Evaluated
2026-07-05
NVD
CVE-2026-30617
EUVD
EUVD-2026-22941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
langchain chatchat 0.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LangChain-ChatChat version 0.3.1 has a remote code execution vulnerability related to its MCP STDIO server configuration and execution handling.

A remote attacker can access the publicly exposed MCP management interface and configure the MCP STDIO server with commands and arguments controlled by the attacker.

When the MCP server is started and MCP is enabled for agent execution, any subsequent agent activity can trigger the execution of arbitrary commands on the server.

This means an attacker can execute arbitrary commands within the context of the LangChain-ChatChat service remotely.

Impact Analysis

This vulnerability allows a remote attacker to execute arbitrary commands on the server running LangChain-ChatChat.

Such arbitrary command execution can lead to unauthorized control over the server, potentially compromising data, disrupting service, or allowing further attacks within the environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart