CVE-2026-54449: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in langbot-app LangBot
Description
CVE-2026-54449 is a command injection vulnerability in LangBot, a global IM bot platform for LLMs. Versions 4.10.7 and earlier allow any authenticated user to modify the STDIO MCP server configuration without proper authorization. This flaw enables execution of arbitrary commands on the server with LangBot service privileges, potentially leading to data disclosure, modification, and service disruption. No patch or fixed version is currently available.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In LangBot versions 4.10.7 and earlier, the StdioServerParameters component accepts user-configured commands and arguments to start a server-side subprocess. Due to insufficient authorization checks, any authenticated user can add or change the STDIO MCP server configuration, resulting in command injection (CWE-77). This allows attackers to execute arbitrary commands with the privileges of the LangBot service, impacting confidentiality, integrity, and availability.
Potential Impact
An attacker with an authenticated account can execute arbitrary commands on the LangBot server with service-level privileges. This can lead to unauthorized data disclosure, data modification, and disruption of service availability. The vulnerability has a high CVSS score of 8.8, indicating a serious risk to affected systems.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should restrict access to authenticated accounts and monitor for suspicious activity. Follow vendor advisories for updates on remediation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3pvh-63gf-j9mw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54449"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a58b50e68715ace43db326a
Added to database: 07/16/2026, 10:40:14 UTC
Last enriched: 09/12/2026, 13:16:27 UTC
Last updated: 10/17/2026, 18:48:20 UTC
Views: 141
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.