Raw JSON data is treated as a tool call without verifying the source, allowing any tool registered with handle=True to be invoked by malicious input. This flaw aligns with CWE‑75, an insecure handling of user‑supplied input that can lead to exploitation. An attacker can craft a JSON payload that the system executes as a tool request, potentially enabling the use of arbitrary tools and causing harmful effects in the application.

The flaw appears in Langroid versions earlier than 0.65.3. Versions prior to 0.65 expose a chat interface to untrusted users and register tools with use=False and handle=True, making them vulnerable. Updating to 0.65.3 or later eliminates the vulnerability. The affected product is the langroid:langroid framework.

The CVSS score of 8.1 indicates a high impact vulnerability. However, the EPSS score of < 1 % suggests a very low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Attackers would most likely exploit the vulnerability by sending malicious JSON payloads directly to the chat endpoint; no prior authentication or privilege is required for the exploitation. The attack vector is inferred from the exposed interface.