LangChain < 0.2.5 SQLi through Prompt Injection

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a prompt injection vulnerability in the GraphCypherQAChain class which leads to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service DoS...

LangChain 代码问题漏洞

LangChain is a LangChain open source implementation of a locally hosted chatbot dedicated to answering questions via LangChain documents. LangChain suffers from a code issue vulnerability that stems from the FAISS.deserializefrombytes function's pickle deserialization of untrustworthy data, which...

CVE-2024-3095 SSRF in Langchain Web Research Retriever in langchain-ai/langchain

A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This...

PT-2024-26659

Name of the Vulnerable Software and Affected Versions langchain-ai/langchain affected versions not specified Description langchain-ai/langchain is susceptible to a path traversal issue stemming from insufficient restriction of pathnames within its LocalFileStore functionality. This allows attacke...

GHSA-H59X-P739-982C LangChain directory traversal vulnerability

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

PYSEC-2024-45

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

PYSEC-2024-43

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

PT-2024-22256 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain versions 0.1.10 and earlier Description: The issue allows an actor who can control the final part of the path parameter in a load chain call to perform ../ directory traversal. This bypasses the intended behavior of loading...

PT-2024-21902

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 0.1.8 langchain experimental versions prior to 0.0.52 Description The issue allows an attacker to bypass a previous fix and execute arbitrary code via certain attributes in Python code, including import , subclasses...

CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

LangChain Security Breach

LangChain is used to build applications using LLM through composability. A security vulnerability exists in LangChain langchainexperimental version 0.0.14, which originated from a vulnerability that allows attackers to bypass the CVE-2023-36258 fix and execute arbitrary code via PALChain in the...

PYSEC-2023-163

An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library...

GHSA-7GFQ-F96F-G85J langchain vulnerable to arbitrary code execution

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the loadprompt parameter. This is related to subclasses or a template...

PYSEC-2023-151

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the loadprompt parameter...

CVE-2023-39659

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...

CVE-2023-38896

An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the frommathprompt and fromcoloredobjectprompt functions...

LangChain Injection Vulnerability

LangChain is used to build applications using LLM through composability. A security vulnerability exists in langchain version 0.0.194 and earlier versions, which results from arbitrary code execution via the frommathprompt and fromcoloredobjectprompt functions...

PT-2023-26641 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain versions 0.0.231 through 0.0.246 Description: An issue in LangChain allows a remote attacker to execute arbitrary code via the prompt parameter. This enables the attacker to potentially gain control over the system, leading to sever...

LangChain Injection Vulnerability

LangChain is an application built using LLM through composability. A security vulnerability exists in LangChain version v.0.0.232, which originates from arbitrary code execution via the PythonAstREPLTool.run component...