8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54771

CVE-2026-54771: Langroid: handle_message() executes user-supplied tool JSON without sender verification

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with use=False, handle=True. Version 0.65.3 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54771

CVE-2026-54771:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langroid	pip	<= 0.65.2	0.65.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handle_message and handle_message_async methods of the ChatAgent class in langroid/agent/base.py. These methods were responsible for processing incoming messages and dispatching tool calls. However, they failed to differentiate between messages originating from the user and messages from the LLM. This allowed a user to craft a message containing a raw JSON payload for a tool and have it executed, even if the tool was configured with use=False, which is intended to prevent the LLM from using it. The patch introduces a new method, _filter_user_origin_tools, which is called from both handle_message and handle_message_async. This new method checks if a message originates from a user and, if so, filters out any tools that are not explicitly marked as usable by the LLM. This ensures that users cannot directly invoke tools that they are not supposed to have access to.

Vulnerable functions

ChatAgent.handle_message

langroid/agent/base.py

This function was vulnerable because it processed tool messages without verifying the sender. A user could send a raw JSON payload to invoke a tool that was not intended to be user-invocable, bypassing the LLM.

ChatAgent.handle_message_async

langroid/agent/base.py

This asynchronous version of `handle_message` had the same vulnerability. It processed tool messages without verifying the sender, allowing a user to execute tools directly.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.