Hey there 👋
Found financial-chat while testing my AI security scanner.
136 issues detected. Here are the critical ones:
🔴 CRITICAL: LangChain Arbitrary Code Execution
• CVE-2025-68664 — Serialization injection in langchain-core.
• Upgrade to 1.2.5 or 0.3.81 immediately.
🔴 CRITICAL: JWT Authentication Bypass
• CVE-2024-33663 — Algorithm confusion in python-jose.
• Upgrade to 3.4.0.
🟠 HIGH: Code-Level Issue — CORS Wildcard
• server.py line 40 — CORS allows any origin *.
• Restrict to trusted origins.
🟠 HIGH: 35+ Dependency CVEs
• LangChain path traversal (CVE-2026-34070)
• LangChain pickling RCE (CVE-2024-5998)
• Python-Multipart file write (CVE-2026-24486, CVE-2024-24762)
• Starlette DoS (CVE-2025-62727, CVE-2024-47874)
• Tornado DoS + cookie injection (5 CVEs)
• urllib3 decompression bomb (3 CVEs)
• aiohttp request smuggling (10+ CVEs)
• Full list in attached report.
Full scan attached. Not selling anything — just testing my tool.
Happy to take this down or discuss.
Cheers,
Lucky3mc
Hey there 👋
Found financial-chat while testing my AI security scanner.
136 issues detected. Here are the critical ones:
🔴 CRITICAL: LangChain Arbitrary Code Execution
• CVE-2025-68664 — Serialization injection in langchain-core.
• Upgrade to 1.2.5 or 0.3.81 immediately.
🔴 CRITICAL: JWT Authentication Bypass
• CVE-2024-33663 — Algorithm confusion in python-jose.
• Upgrade to 3.4.0.
🟠 HIGH: Code-Level Issue — CORS Wildcard
• server.py line 40 — CORS allows any origin
*.• Restrict to trusted origins.
🟠 HIGH: 35+ Dependency CVEs
• LangChain path traversal (CVE-2026-34070)
• LangChain pickling RCE (CVE-2024-5998)
• Python-Multipart file write (CVE-2026-24486, CVE-2024-24762)
• Starlette DoS (CVE-2025-62727, CVE-2024-47874)
• Tornado DoS + cookie injection (5 CVEs)
• urllib3 decompression bomb (3 CVEs)
• aiohttp request smuggling (10+ CVEs)
• Full list in attached report.
Full scan attached. Not selling anything — just testing my tool.
Happy to take this down or discuss.
Cheers,
Lucky3mc