CVE-2026-7845 Details

A vulnerability exists in Langchain-Chatchat versions up to 0.3.1.3, specifically within the Vision Chat feature that processes pasted images. The issue arises because the application uses the PIL library's Image.tobytes() method to generate an MD5 hash for image filenames, relying solely on the raw pixel data. This approach ignores essential image metadata, such as dimensions and color information, creating a scenario where two visually distinct images can produce identical byte representations and hash values. As a result, an attacker on the same local network can overwrite a victim's image file, leading to incorrect responses from the language model during chat interactions.

Update the image handling code to use a hashing method that incorporates the complete PNG byte stream, including all metadata, and switch from MD5 to SHA-256 to mitigate collision risks.