Langchain-Chatchat versions up to 0.3.1.3 expose a POST /tools/call API that allows any registered tool to be invoked without authentication, leaving the always‑registered shell tool accessible to anyone who can reach the endpoint. An attacker can send a single request naming the shell tool to execute arbitrary OS commands with the privileges of the server process, which in the supplied Docker image are root. This results in full control of the host system.

The vulnerability affects the Langchain-Chatchat application developed by chatchat-space. All releases through version 0.3.1.3 contain the issue; the problem originates from the tool‑routing logic that does not enforce authentication before allowing tool invocation.

The flaw carries a CVSS score of 9.3, indicating critical severity, and has no mitigations beyond the lack of authentication. The exploit requires only a simple unauthenticated HTTP POST and can be performed from the internet if the server is reachable. The EPSS score is 2%, indicating a low but nonzero exploitation probability. It is not listed in the CISA KEV catalog, but the impact and ease of exploitation make it a high‑priority target for attackers.