CVE-2026-54771: Langroid Framework RCE Vulnerability

CVE-2026-54771 Overview

CVE-2026-54771 affects Langroid, a Python framework for building large-language-model-powered applications. Versions prior to 0.65.3 allow untrusted chat users to directly invoke registered tools through raw JSON payloads. The flaw bypasses the intended access controls, executing tools even when they are registered with use=False, handle=True. The maintainers addressed the issue in version 0.65.3. The vulnerability maps to CWE-75: Failure to Sanitize Special Elements into a Different Plane.

Critical Impact
Authenticated attackers with chat access can invoke privileged tools that developers explicitly disabled for user-driven invocation, leading to confidentiality and integrity impact on the host application.

Affected Products

Langroid framework versions prior to 0.65.3
Applications exposing a Langroid chat interface to untrusted users
Deployments registering tools with use=False, handle=True

Discovery Timeline

2026-07-10 - CVE-2026-54771 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-54771

Vulnerability Analysis

Langroid supports agent-based workflows where tools are registered to a chat agent. The framework provides two orthogonal flags per tool: use controls whether the language model is permitted to emit the tool, and handle controls whether the agent will process a tool invocation when it appears. Setting use=False, handle=True is the documented pattern for tools that only the application backend should trigger, while the agent still handles the resulting output.

The vulnerability arises because the message-handling path in vulnerable versions does not enforce the use=False restriction on tool invocations that originate from the raw chat input stream. An attacker sending a crafted JSON payload through the chat interface reaches the same tool dispatch code path as a legitimate model-generated call. The handle=True setting causes the agent to execute the tool with attacker-controlled arguments.

Root Cause

The root cause is missing input-plane separation between messages authored by the language model and messages authored by the user (CWE-75). Langroid parses tool-shaped JSON from user turns and dispatches it without checking the use flag, treating the user channel as if it were a trusted model output channel.

Attack Vector

Exploitation requires network access to the chat endpoint and low-privilege authentication, consistent with a standard chat user. The attacker submits a JSON payload matching the schema of a registered tool. The Langroid agent parses the payload, resolves the tool by name, and executes its handler with the supplied arguments. No user interaction beyond the attacker's own request is required. See the GitHub Security Advisory GHSA-gjgq-w2m6-wr5q for the maintainer analysis.

// No verified proof-of-concept code is published.
// The vulnerability is triggered by submitting raw JSON matching
// a registered tool's schema through the standard chat input.

Detection Methods for CVE-2026-54771

Indicators of Compromise

Chat transcripts containing user-authored JSON payloads that match the schema of registered Langroid tools.
Application logs showing tool handler execution with no preceding assistant/model message emitting the tool call.
Unexpected outbound requests, file access, or database operations initiated by tool handlers during user chat turns.

Detection Strategies

Instrument Langroid agents to log the origin channel (user vs. model) of every tool dispatch and alert when the origin is user for tools registered with use=False.
Run static review across the codebase for tool registrations using use=False, handle=True and audit their handlers for privileged operations.
Deploy web application firewall rules that identify JSON structures resembling Langroid tool schemas inside user chat fields.

Monitoring Recommendations

Monitor Langroid application logs for handler invocations that do not correlate with a prior model tool-call message.
Track version metadata of deployed Langroid packages and alert on any instance below 0.65.3.
Review authentication logs for chat sessions that generate high volumes of tool-invocation traffic.

How to Mitigate CVE-2026-54771

Immediate Actions Required

Upgrade Langroid to version 0.65.3 or later across all environments exposing chat interfaces to untrusted users.
Inventory every agent configuration that uses use=False, handle=True and confirm the associated handlers are not exploitable if invoked with attacker-controlled arguments.
Restrict chat interface access to authenticated, trusted users until the upgrade is complete.

Patch Information

The maintainers fixed CVE-2026-54771 in Langroid version 0.65.3. The fix enforces the use flag on the user input channel so that tool-shaped JSON submitted by a user cannot invoke tools that are not enabled for model use. Full details are available in the GitHub Security Advisory GHSA-gjgq-w2m6-wr5q.

Workarounds

Temporarily deregister tools that combine use=False with handle=True until the upgrade is deployed.
Add an input validation layer in front of the Langroid agent that rejects user messages containing JSON matching known tool schemas.
Isolate Langroid deployments in a sandbox with least-privilege credentials so that any unauthorized tool execution is contained.

bash

# Upgrade Langroid to the patched version
pip install --upgrade 'langroid>=0.65.3'

# Verify the installed version
python -c "import langroid; print(langroid.__version__)"