logo

Database

Lack of data validation - Path Traversal In langchain

Description

LangChain directory traversal vulnerability LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2024-280882. NVD-2024-280883. OSV-2024-280884. GCVE-2024-28088

References

1. https://github.com/langchain-ai/langchain/pull/186002. https://github.com/langchain-ai/langchain/commit/e1924b3e93d513ca950c72f8e80e1c133749fba53. https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md4. https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py5. https://github.com/pypa/advisory-database/tree/main/vulns/langchain-core/PYSEC-2024-45.yaml6. https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-43.yaml7. https://github.com/levpachmanov/cve-2024-28088-poc

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.