Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LangChain

CVE-2024-8309: Langchain SQL Injection vulnerability

lowCVSS 4.0 2.1 · 3.0 4.9GHSA-45pg-36p6-83v9

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues.

Published Oct 29, 2024 · Updated Nov 12, 2024

Affected packages

langchain

Ecosystem
PyPI
Affected
< 0.2.0
Fixed in
0.2.0
Check
pip show langchain

langchain-community

Ecosystem
PyPI
Affected
>= 0.2.0, < 0.2.19
Fixed in
0.2.19
Check
pip show langchain-community

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

Credited to BarrensZeppelin, eyurtsev, efriis.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LangChain vulnerabilities

All LangChain entries