Executive brief
Langroid is a software framework used to build applications powered by Large Language Models (LLMs), such as AI chatbots. A security flaw allows users to bypass safety controls and directly trigger internal tools or commands by sending specially formatted JSON messages. Depending on the tools available in the application, this could allow an attacker to read sensitive files, modify databases, or gain unauthorized access to internal systems.
Technical details
A vulnerability in Langroid's message handling logic allows for direct tool invocation via raw JSON payloads, even when tools are configured with `use=False`. The root cause is that the `handle_message()` and `get_tool_messages()` functions in the `ChatAgent` class failed to verify whether a message originated from a trusted entity (the LLM) or an untrusted entity (the USER). While version 0.65.3 introduced a basic filter, it was found that the restriction could still be bypassed in multi-agent setups through 'taint laundering' where user input is re-emitted by an agent. Version 0.65.7 introduces robust taint propagation to ensure that any tool request originating from external user input is blocked from executing handle-only tools. An attacker with network access to a chat interface can exploit this to execute arbitrary registered tools, potentially leading to unauthorized data access or system modification.
Affected products
- langroid Langroid < 0.65.7
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: NVD publication date
- 2026-07-10: patched: Final remediation in version 0.65.7