A flaw exists in the Vision Chat Paste Image Handler of chatchat-space's Langchain‑Chatchat v0.3.1.3 and earlier, where the function PIL.Image.tobytes is called with untrusted paste_image.image_data and uses a weak hash algorithm, thereby enabling an adversary to generate hash collisions in the image data handling. This weakness can allow attackers to craft inputs that bypass integrity checks, potentially leading to tampering or spoofing of pasted images. While no direct exploitation of arbitrary code execution is described, the use of weak cryptographic primitives poses a risk to data integrity within the chat application.

The vulnerability affects all deployments of chatchat-space's Langchain‑Chatchat up to and including version 0.3.1.3, specifically the component located in libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py. Users running this product on their local networks without an available patch are exposed.

With a CVSS score of 2.1 the severity is low, but the vulnerability has been published and the exploit is considered difficult to achieve. The attacker must be present on the local network and the attack requires high complexity. The EPSS score is not available and the issue is not listed in CISA's KEV catalog, suggesting limited current exploitation, yet the low severity does not reduce the need for vigilance in environments where image integrity is critical.