CVE-2026-54449: LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP

Executive brief

LangBot, a tool for managing AI bot interactions, contains a vulnerability that allows any logged-in user to execute arbitrary commands on the server. By adding a malicious configuration to the Model Context Protocol (MCP) extension, an attacker can gain full control over the host machine. This could lead to the theft of sensitive data, complete service disruption, or the use of the server for further attacks.

Technical details

LangBot is vulnerable to OS command injection (CWE-77/CWE-78) via its Model Context Protocol (MCP) configuration interface. The application utilizes 'StdioServerParameters' from the Anthropic MCP library in 'src/langbot/pkg/provider/tools/loaders/mcp.py', which executes user-provided commands as subprocesses. An authenticated attacker can navigate to the Extensions/MCP tab and add a new 'STDIO' server with arbitrary shell commands. These commands are executed on the host machine with the privileges of the LangBot process, allowing for full system compromise. As of the advisory date, no patched version has been identified.

Affected products

• RockChinQ langbot <= 4.10.5

Timeline

• 2026-06-04: disclosed: Vulnerability reported to vendor
• 2026-07-15: advisory: GitHub Advisory published

References

• https://api.github.com/users/MosesOX
• https://github.com/MosesOX
• https://api.github.com/users/MosesOX/gists%7B/gist_id%7D
• https://api.github.com/users/MosesOX/repos
• https://avatars.githubusercontent.com/u/189734019?v=4
• https://api.github.com/users/MosesOX/events%7B/privacy%7D