Langbot-App Langbot
5 CVEs affecting Langbot-App Langbot. Latest disclosed: 2026-09-14. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54449 | High | 8.8 | 2026-08-20 | LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuratio… |
CVE-2026-90938 | High | 8.6 | 2026-09-14 | LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated… |
CVE-2026-90562 | High | 8.1 | 2026-09-13 | LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoin… |
CVE-2026-28509 | Medium | 6.3 | 2026-03-06 | LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead… |
CVE-2025-59835 | | 2025-10-02 | LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/docu… |