AI agent vulnerability · LangChain

CVE-2024-28088: LangChain directory traversal vulnerability

lowGHSA-h59x-p739-982c

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

Published Mar 4, 2024 · Updated Mar 14, 2024

Affected packages

langchain

Ecosystem: PyPI
Affected: < 0.0.339
Fixed in: 0.0.339
Check: pip show langchain

langchain-core

Ecosystem: PyPI
Affected: >= 0, < 0.1.30
Fixed in: 0.1.30
Check: pip show langchain-core

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

Credited to levpachmanov.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LangChain vulnerabilities

All LangChain entries