Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-90938 (GCVE-0-2026-90938)

Vulnerability from nvd – Published: 2026-09-14 12:48 – Updated: 2026-09-14 13:29

Title

LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

Summary

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary "debug plugin" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker's plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering with "prod_mode": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 13:29 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/langbot-thro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: 0 , ≤ 0.4.17 (semver) cpe:2.3:a:langbot:langbot::::::::

Date Public

2026-07-31 00:00

Credits

T4rnRookie

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90938",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T13:29:50.111076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:29:58.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/langbot_plugin",
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "lessThanOrEqual": "0.4.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:langbot:langbot:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "T4rnRookie"
        }
      ],
      "datePublic": "2026-07-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot\u0027s plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary \"debug plugin\" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker\u0027s plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user\u0027s LLM pipeline. Registering with \"prod_mode\": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:48:32.108Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m7qm-2mjr-2h4q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-m7qm-2mjr-2h4q"
        },
        {
          "name": "VulnCheck Advisory: LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/langbot-through-0.4.17-unauthenticated-plugin-registration-via-websocket"
        }
      ],
      "title": "LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-90938",
    "datePublished": "2026-09-14T12:48:32.108Z",
    "dateReserved": "2026-09-14T11:34:24.687Z",
    "dateUpdated": "2026-09-14T13:29:58.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-90562 (GCVE-0-2026-90562)

Vulnerability from nvd – Published: 2026-09-13 10:45 – Updated: 2026-09-16 14:01

Title

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Summary

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:01 UTC

CWE

CWE-331 - Insufficient Entropy

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://github.com/langbot-app/LangBot/issues/2392	issue-tracking
https://github.com/langbot-app/LangBot	product
https://github.com/langbot-app/LangBot/blob/v4.10…	technical-description
https://github.com/langbot-app/LangBot/blob/v4.10…	technical-description
https://github.com/langbot-app/LangBot/commit/267…	patch
https://www.vulncheck.com/advisories/langbot-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: 4.0.8.1 , < 4.10.11 (custom) cpe:2.3:a:langbot:langbot::::::::

Date Public

2026-08-04 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90562",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:01:27.102549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:01:56.471Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/langbot-app/LangBot/issues/2392"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/langbot",
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "4.0.8.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:langbot:langbot:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.10.11",
                  "versionStartIncluding": "4.0.8.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-331",
              "description": "Insufficient Entropy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T10:45:36.684Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2392",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/langbot-app/LangBot/issues/2392"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/langbot-app/LangBot"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/core/stages/genkeys.py"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/api/http/controller/groups/user.py"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/langbot-app/LangBot/commit/267232c24f93c515d6fd3f7f81c0676066ab1ab8"
        },
        {
          "name": "VulnCheck Advisory: LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/langbot-before-4.10.11-authentication-bypass-via-weak-recovery-key"
        }
      ],
      "title": "LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-90562",
    "datePublished": "2026-09-13T10:45:36.684Z",
    "dateReserved": "2026-09-12T11:13:43.327Z",
    "dateUpdated": "2026-09-16T14:01:56.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54449 (GCVE-0-2026-54449)

Vulnerability from nvd – Published: 2026-08-20 16:10 – Updated: 2026-08-21 21:47

Title

LangBot: Authenticated RCE Via MCP Configuration

Summary

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:00 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	x_refsource_CONFIRM
https://www.ox.security/blog/mcp-supply-chain-adv…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: <= 4.10.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:00:27.881131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:47:30.890Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 4.10.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T16:10:25.169Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw"
        },
        {
          "name": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem"
        }
      ],
      "source": {
        "advisory": "GHSA-3pvh-63gf-j9mw",
        "discovery": "UNKNOWN"
      },
      "title": "LangBot: Authenticated RCE Via MCP Configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54449",
    "datePublished": "2026-08-20T16:10:25.169Z",
    "dateReserved": "2026-06-15T15:30:40.317Z",
    "dateUpdated": "2026-08-21T21:47:30.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28509 (GCVE-0-2026-28509)

Vulnerability from nvd – Published: 2026-03-06 04:16 – Updated: 2026-03-06 16:07

Title

LangBot has a Cross Site Scripting(XSS) Vulnerability

Summary

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-06 15:50 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	x_refsource_CONFIRM
https://github.com/langbot-app/LangBot/commit/614…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: < 4.8.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28509",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T15:50:37.548729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T16:07:49.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.8.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot\u2019s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T04:16:58.761Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-w8gq-g4pc-xh3h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-w8gq-g4pc-xh3h"
        },
        {
          "name": "https://github.com/langbot-app/LangBot/commit/614621ab7b84fe50da3c6137705cde5a99429866",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langbot-app/LangBot/commit/614621ab7b84fe50da3c6137705cde5a99429866"
        }
      ],
      "source": {
        "advisory": "GHSA-w8gq-g4pc-xh3h",
        "discovery": "UNKNOWN"
      },
      "title": "LangBot has a Cross Site Scripting(XSS) Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28509",
    "datePublished": "2026-03-06T04:16:58.761Z",
    "dateReserved": "2026-02-27T20:57:47.709Z",
    "dateUpdated": "2026-03-06T16:07:49.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59835 (GCVE-0-2025-59835)

Vulnerability from nvd – Published: 2025-10-02 18:59 – Updated: 2025-10-02 19:50

Title

LangBot has a cross-directory file upload vulnerability, which could lead to system takeover

Summary

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-02 19:50 UTC

CWE

CWE-23 - Relative Path Traversal
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	x_refsource_CONFIRM
https://github.com/langbot-app/LangBot/pull/1691	x_refsource_MISC
https://github.com/langbot-app/LangBot/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: >= 4.1.0, < 4.3.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59835",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-02T19:50:28.048098Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-02T19:50:39.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.3.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-02T18:59:42.808Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4"
        },
        {
          "name": "https://github.com/langbot-app/LangBot/pull/1691",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langbot-app/LangBot/pull/1691"
        },
        {
          "name": "https://github.com/langbot-app/LangBot/releases/tag/v4.3.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langbot-app/LangBot/releases/tag/v4.3.5"
        }
      ],
      "source": {
        "advisory": "GHSA-7j3j-qj83-9qv4",
        "discovery": "UNKNOWN"
      },
      "title": "LangBot has a cross-directory file upload vulnerability, which could lead to system takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59835",
    "datePublished": "2025-10-02T18:59:42.808Z",
    "dateReserved": "2025-09-22T14:34:03.471Z",
    "dateUpdated": "2025-10-02T19:50:39.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-90938 (GCVE-0-2026-90938)

Vulnerability from cvelistv5 – Published: 2026-09-14 12:48 – Updated: 2026-09-14 13:29

Title

LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

Summary

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary "debug plugin" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker's plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering with "prod_mode": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 13:29 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/langbot-thro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: 0 , ≤ 0.4.17 (semver) cpe:2.3:a:langbot:langbot::::::::

Date Public

2026-07-31 00:00

Credits

T4rnRookie

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90938",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T13:29:50.111076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:29:58.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/langbot_plugin",
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "lessThanOrEqual": "0.4.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:langbot:langbot:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "T4rnRookie"
        }
      ],
      "datePublic": "2026-07-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot\u0027s plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary \"debug plugin\" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker\u0027s plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user\u0027s LLM pipeline. Registering with \"prod_mode\": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:48:32.108Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m7qm-2mjr-2h4q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-m7qm-2mjr-2h4q"
        },
        {
          "name": "VulnCheck Advisory: LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/langbot-through-0.4.17-unauthenticated-plugin-registration-via-websocket"
        }
      ],
      "title": "LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-90938",
    "datePublished": "2026-09-14T12:48:32.108Z",
    "dateReserved": "2026-09-14T11:34:24.687Z",
    "dateUpdated": "2026-09-14T13:29:58.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-90562 (GCVE-0-2026-90562)

Vulnerability from cvelistv5 – Published: 2026-09-13 10:45 – Updated: 2026-09-16 14:01

Title

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Summary

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:01 UTC

CWE

CWE-331 - Insufficient Entropy

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://github.com/langbot-app/LangBot/issues/2392	issue-tracking
https://github.com/langbot-app/LangBot	product
https://github.com/langbot-app/LangBot/blob/v4.10…	technical-description
https://github.com/langbot-app/LangBot/blob/v4.10…	technical-description
https://github.com/langbot-app/LangBot/commit/267…	patch
https://www.vulncheck.com/advisories/langbot-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: 4.0.8.1 , < 4.10.11 (custom) cpe:2.3:a:langbot:langbot::::::::

Date Public

2026-08-04 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90562",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:01:27.102549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:01:56.471Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/langbot-app/LangBot/issues/2392"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/langbot",
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "lessThan": "4.10.11",
              "status": "affected",
              "version": "4.0.8.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:langbot:langbot:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.10.11",
                  "versionStartIncluding": "4.0.8.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-331",
              "description": "Insufficient Entropy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T10:45:36.684Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2392",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/langbot-app/LangBot/issues/2392"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/langbot-app/LangBot"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/core/stages/genkeys.py"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/api/http/controller/groups/user.py"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/langbot-app/LangBot/commit/267232c24f93c515d6fd3f7f81c0676066ab1ab8"
        },
        {
          "name": "VulnCheck Advisory: LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/langbot-before-4.10.11-authentication-bypass-via-weak-recovery-key"
        }
      ],
      "title": "LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-90562",
    "datePublished": "2026-09-13T10:45:36.684Z",
    "dateReserved": "2026-09-12T11:13:43.327Z",
    "dateUpdated": "2026-09-16T14:01:56.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54449 (GCVE-0-2026-54449)

Vulnerability from cvelistv5 – Published: 2026-08-20 16:10 – Updated: 2026-08-21 21:47

Title

LangBot: Authenticated RCE Via MCP Configuration

Summary

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:00 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	x_refsource_CONFIRM
https://www.ox.security/blog/mcp-supply-chain-adv…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: <= 4.10.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:00:27.881131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:47:30.890Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 4.10.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T16:10:25.169Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw"
        },
        {
          "name": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem"
        }
      ],
      "source": {
        "advisory": "GHSA-3pvh-63gf-j9mw",
        "discovery": "UNKNOWN"
      },
      "title": "LangBot: Authenticated RCE Via MCP Configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54449",
    "datePublished": "2026-08-20T16:10:25.169Z",
    "dateReserved": "2026-06-15T15:30:40.317Z",
    "dateUpdated": "2026-08-21T21:47:30.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28509 (GCVE-0-2026-28509)

Vulnerability from cvelistv5 – Published: 2026-03-06 04:16 – Updated: 2026-03-06 16:07

Title

LangBot has a Cross Site Scripting(XSS) Vulnerability

Summary

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-06 15:50 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	x_refsource_CONFIRM
https://github.com/langbot-app/LangBot/commit/614…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: < 4.8.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28509",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T15:50:37.548729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T16:07:49.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.8.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot\u2019s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T04:16:58.761Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-w8gq-g4pc-xh3h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-w8gq-g4pc-xh3h"
        },
        {
          "name": "https://github.com/langbot-app/LangBot/commit/614621ab7b84fe50da3c6137705cde5a99429866",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langbot-app/LangBot/commit/614621ab7b84fe50da3c6137705cde5a99429866"
        }
      ],
      "source": {
        "advisory": "GHSA-w8gq-g4pc-xh3h",
        "discovery": "UNKNOWN"
      },
      "title": "LangBot has a Cross Site Scripting(XSS) Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28509",
    "datePublished": "2026-03-06T04:16:58.761Z",
    "dateReserved": "2026-02-27T20:57:47.709Z",
    "dateUpdated": "2026-03-06T16:07:49.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59835 (GCVE-0-2025-59835)

Vulnerability from cvelistv5 – Published: 2025-10-02 18:59 – Updated: 2025-10-02 19:50

Title

LangBot has a cross-directory file upload vulnerability, which could lead to system takeover

Summary

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-02 19:50 UTC

CWE

CWE-23 - Relative Path Traversal
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/langbot-app/LangBot/security/a…	x_refsource_CONFIRM
https://github.com/langbot-app/LangBot/pull/1691	x_refsource_MISC
https://github.com/langbot-app/LangBot/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
langbot-app	LangBot	Affected: >= 4.1.0, < 4.3.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59835",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-02T19:50:28.048098Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-02T19:50:39.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LangBot",
          "vendor": "langbot-app",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.3.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-02T18:59:42.808Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4"
        },
        {
          "name": "https://github.com/langbot-app/LangBot/pull/1691",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langbot-app/LangBot/pull/1691"
        },
        {
          "name": "https://github.com/langbot-app/LangBot/releases/tag/v4.3.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langbot-app/LangBot/releases/tag/v4.3.5"
        }
      ],
      "source": {
        "advisory": "GHSA-7j3j-qj83-9qv4",
        "discovery": "UNKNOWN"
      },
      "title": "LangBot has a cross-directory file upload vulnerability, which could lead to system takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59835",
    "datePublished": "2025-10-02T18:59:42.808Z",
    "dateReserved": "2025-09-22T14:34:03.471Z",
    "dateUpdated": "2025-10-02T19:50:39.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities found for LangBot by langbot-app

CVE-2026-90938 (GCVE-0-2026-90938)

CVE-2026-90562 (GCVE-0-2026-90562)

CVE-2026-54449 (GCVE-0-2026-54449)

CVE-2026-28509 (GCVE-0-2026-28509)

CVE-2025-59835 (GCVE-0-2025-59835)

CVE-2026-90938 (GCVE-0-2026-90938)

CVE-2026-90562 (GCVE-0-2026-90562)

CVE-2026-54449 (GCVE-0-2026-54449)

CVE-2026-28509 (GCVE-0-2026-28509)

CVE-2025-59835 (GCVE-0-2025-59835)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities found for LangBot by langbot-app

CVE-2026-90938 (GCVE-0-2026-90938)

CVE-2026-90562 (GCVE-0-2026-90562)

CVE-2026-54449 (GCVE-0-2026-54449)

CVE-2026-28509 (GCVE-0-2026-28509)

CVE-2025-59835 (GCVE-0-2025-59835)

CVE-2026-90938 (GCVE-0-2026-90938)

CVE-2026-90562 (GCVE-0-2026-90562)

CVE-2026-54449 (GCVE-0-2026-54449)

CVE-2026-28509 (GCVE-0-2026-28509)

CVE-2025-59835 (GCVE-0-2025-59835)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.