raw JSON data as a tool call without verifying who sent it. Consequently, an attacker can supply specially crafted JSON that the system interprets as a request to run any tool registered with handle=True, a practice that aligns with CWE‑75, insecure handling of user‑supplied input. An attacker could potentially trigger harmful behavior such as executing from the ability to invoke arbitrary tools.)

The flaw appears in Langroid versions earlier than 0.65 exposes a chat interface to untrusted users and registers tools with use=False and handle=True is vulnerable. Updating to 0.65.3 or later eliminates the vulnerability. The affected product is the langroid:langroid framework.

The CVSS score of 8.1 indicates high impact and medium to high exploitability. Given the EPSS score is reported as < 1 %, the likelihood of exploitation in the wild is currently low, and the flaw is not listed in the CISA KEV catalog. Attackers would most likely exploit the vulnerability by sending malicious JSON payloads directly to the chat endpoint; no prior authentication or privilege is required for the exploitation. The attack vector is inferred from to the exposed interface.