CVE-2026-54771: Langroid unauthorized tool invocation via raw JSON payloads

CVE-2026-54771 · Severity: high · CVSS 8.1 · Published 2026-07-10

Langroid is a software framework used to build applications powered by Large Language Models (LLMs), such as AI chatbots. A security flaw allows users to bypass safety controls and directly trigger internal tools or commands by sending specially formatted JSON messages. Depending on the tools available in the application, this could allow an attacker to read sensitive files, modify databases, or gain unauthorized access to internal systems.

Technologies: langroid (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54771 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54771 being exploited in the wild.
How severe is CVE-2026-54771?
High severity, with a CVSS score of 8.1, published 10 July 2026.
Which products and versions are affected?
langroid (PyPI) <= 0.65.2, ECOSYSTEM:introduced=0,fixed=0.65.3.
Is there a fix for CVE-2026-54771?
Yes. langroid (PyPI): upgrade to 0.65.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54771 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54771?
Check whether you run langroid (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langroid (PyPI): upgrade to 0.65.3 or later
    pip install "langroid>=0.65.3"

Technical details

A vulnerability in Langroid's message handling logic allows for direct tool invocation via raw JSON payloads, even when tools are configured with `use=False`. The root cause is that the `handle_message()` and `get_tool_messages()` functions in the `ChatAgent` class failed to verify whether a message originated from a trusted entity (the LLM) or an untrusted entity (the USER). While version 0.65.3 introduced a basic filter, it was found that the restriction could still be bypassed in multi-agent setups through 'taint laundering' where user input is re-emitted by an agent. Version 0.65.7 introduces robust taint propagation to ensure that any tool request originating from external user input is blocked from executing handle-only tools. An attacker with network access to a chat interface can exploit this to execute arbitrary registered tools, potentially leading to unauthorized data access or system modification.

Affected products

  • langroid Langroid < 0.65.7

Identifiers

  • CVE-2026-54771
  • GHSA-gjgq-w2m6-wr5q
  • PYSEC-2026-2579

Timeline

  • 2026-06-09: advisory: GitHub Security Advisory published
  • 2026-07-09: disclosed: NVD publication date
  • 2026-07-10: patched: Final remediation in version 0.65.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.