CVE-2026-54771

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with `use=False, handle=True`. Version 0.65.3 fixes the issue.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 32th percentile

Published

2026-07-09

Updated

2026-07-10

Proof-of-concept exploits (1)

• advisories/GHSA-gjgq-w2m6-wr5q

References

• CVE Record
• NVD entry

Related

• CVE-2026-54769
• CVE-2026-54787
• CVE-2026-54768
• CVE-2026-54806
• CVE-2026-54766
• CVE-2026-54807