This vulnerability affects the chatchat-space Langchain-Chatchat product up to version 0.3.1.3. It involves the use of a weak hash algorithm in the Vision Chat Paste Image Handler, specifically in the PIL.Image.tobytes function when processing image data. An attacker on the local network could potentially exploit this weakness, but the attack complexity is high and exploitability is difficult. The issue was reported early to the project, but no response or fix has been issued. The CVSS 4.0 vector indicates attack vector as adjacent network, high attack complexity, no privileges required, no user interaction, and low impact on confidentiality and integrity.

The impact is limited due to the low CVSS score (2.1) and the requirement for the attacker to be on the local network with high complexity to exploit. The vulnerability involves weak hashing which may affect data integrity verification in the Vision Chat Paste Image Handler, but no direct privilege escalation or data disclosure is indicated. No known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or issued a fix, users should monitor the vendor advisory for updates. Given the high complexity and local network requirement, risk is limited but users should consider restricting local network access to trusted parties and apply general network security controls. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.