LangChain-ChatChat 0.3.1 contains a remote code execution flaw that allows an attacker to configure the MCP STDIO server with arbitrary commands through a publicly exposed management interface. Once the server is started and agent execution is enabled, the configured commands are executed during subsequent agent activity, giving the attacker unrestricted execution inside the LangChain-ChatChat service. The vulnerability stems from a lack of proper validation of command inputs, enabling arbitrary command injection. The likely attack vector is a network-based request to the MCP management interface exposed to the internet.

The affected product is LangChain-ChatChat version 0.3.1. No other vendors or product variants are listed; the vulnerability is tied to the specific MCP STDIO server component of this version.

Because the attack does not require local privilege and only needs access to the management interface, it poses a high‑severity risk. The CVSS score is 8.6, and EPSS is not available, so exploitation probability is unknown, but the nature of remote code execution means a successful exploit would give attackers full control over the service. The vulnerability is not currently listed in CISA’s KEV catalog, yet its potential impact warrants close monitoring.