AI agent vulnerability · LangChain

CVE-2024-7774: Langchain Path Traversal vulnerability

mediumCVSS 4.0 6.9 · 3.0 6.5GHSA-hc5w-c9f8-9cc4

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The vulnerability is exploited through the setFileContent, getParsedFile, and mdelete methods, which do not properly sanitize user input.

Published Oct 29, 2024 · Updated Nov 1, 2024

Affected packages

langchain

Ecosystem: npm
Affected: < 0.2.19
Fixed in: 0.2.19
Check: npm ls langchain

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The vulnerability is exploited through the setFileContent, getParsedFile, and mdelete methods, which do not properly sanitize user input.

Credited to hinthornw.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LangChain vulnerabilities

All LangChain entries