What happened
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without any authentication, leaving the always-registered shell tool callable. A remote attacker sends a single request naming the shell tool to execute arbitrary OS commands as the server user — root in the shipped Docker image.
Why it matters
This turns a public chat/RAG backend into a pre-auth root shell. Because ChatChat is a widely-deployed Chinese RAG/chatbot framework often exposed to the internet, an attacker can pivot to the host, read the LLM/database credentials the service holds, and tamper with the knowledge base or model pipeline.
Attack vector
Unauthenticated POST /tools/call naming the always-registered shell tool
Affected systems
Langchain-Chatchat <= 0.3.1.3 (pypi langchain-chatchat)
Mitigation
Upgrade to a fixed release and add authentication/allow-listing on /tools/call; restrict which tools are registered server-side