CVE-2026-54771

—

CVSS 3.1

8.1 high

EPSS

<1%p33

Published

Jul 10, 2026 (Jul 10, 2026)

Modified

Jul 10, 2026

Description

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with `use=False, handle=True`. Version 0.65.3 fixes the issue.

Weakness: CWE-75
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.