CVE-2026-54771

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.65.3

Description An application using this framework that exposes a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads. This occurs even when tools are registered with use=False, handle=True, as the tool dispatch path in agent response() → handle message() → get tool messages() fails to verify if the message originated from the user or the LLM. Consequently, a user can bypass intended restrictions by sending raw tool JSON as chat input to directly invoke the handler. Depending on the enabled tools, this could lead to unauthorized file read/write operations, database query execution, or access to internal orchestration tools.

Recommendations Update to version 0.65.3.