LangChain < 0.2.9 Vulnerability - CVE-2024-5998

The version of LangChain installed on the remote host is prior to 0.2.9. It is, therefore, affected by a deserialization vulnerability in the FAISS.deserializefrombytes function. This can lead to the execution of arbitrary commands via the os.system function. Note that Nessus has not tested for...

LangChain < 0.1.35 XXE

The version of LangChain installed on the remote host is prior to 0.1.35. It is, therefore, affected by a XML External Entity XXE vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers o...

PYSEC-2024-115

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tena...

PYSEC-2024-115

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tena...

Read from host file system via ImagePromptTemplate in langchain-core

Description You can create langchaincore.prompts.ImagePromptTemplate's and by extension the langchaincore.prompts.ChatPromptTemplate's with input variables that make it possible for the prompt template to read any user-specified path from the server file system. If the outputs of the prompt...

@aerocorp/cli (7.0.5), @aj-archipelago/cortex (>=1.1.7, <=1.3.16) +328 more potentially affected by CVE-2024-7042 via @langchain/community (>=0.0.15, <=0.3.2)

@langchain/community NPM version =0.0.15, =1.1.7, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =2.0.0-next.2, =1.0.0-alpha.0, =0.2.13-alpha.0, =0.0.28, =0.0.11, =0.0.18 and more Source cves: CVE-2024-7042 Source advisory: OSV:GHSA-6M59-8FMV-M5F9...

10minions-engine (>=0.0.1, <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1) +473 more potentially affected by CVE-2024-7774 via langchain (>=0.0.11, <=0.2.10)

langchain NPM version =0.0.11, =0.0.1, =1.0.0, =0.1.4, =0.0.11, =0.0.0, =0.0.2-alpha, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =2.0.68, =0.1.0, =0.1.4 - @builderbot-plugins/free-gpt 0.0.6-alpha.0 and more Source cves: CVE-2024-7774 Source advisory: OSV:GHSA-HC5W-C9F8-9CC4...

10minions-engine (>=0.0.1, <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1) +473 more potentially affected by CVE-2024-7774 via langchain (>=0.0.11, <=0.2.10)

langchain NPM version =0.0.11, =0.0.1, =1.0.0, =0.1.4, =0.0.11, =0.0.0, =0.0.2-alpha, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =2.0.68, =0.1.0, =0.1.4 - @builderbot-plugins/free-gpt 0.0.6-alpha.0 and more Source cves: CVE-2024-7774 Source advisory: GHSA-HC5W-C9F8-9CC4...

Langchain SQL Injection vulnerability

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tenant securit...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the GraphCypherQAChain class. An attacker can manipulate, delete, or create data, disrupt services, and compromise database integrity by injecting malicious SQL commands into prompts. Note: This vulnerability impac...

assistant (>=1.1.0b1, <=1.2.1b1), autonomous-agent (0.0.1) +60 more potentially affected by CVE-2024-8309 via langchain-community (>=0.2.5, <=0.2.17)

langchain-community PYPI version =0.2.5, =1.1.0b1, =0.0.549, =0.2.0b1, =1.5.0, =0.1.1, =0.0.2.7, =0.2.0, =0.4.0, =0.1.3, =0.1.3, =0.1.0, =0.1.3, =0.1.7 and more Source cves: CVE-2024-8309 Source advisory: SNYK:PYTHON-LANGCHAINCOMMUNITY-8310287...

aiagentgraph (>=0.0.1, <=0.0.4a1), apsbot (>=0.2.0, <=0.3.1) +79 more potentially affected by CVE-2024-8309 via langchain-community (>=0.2.0, <=0.2.17)

langchain-community PYPI version =0.2.0, =0.0.1, =0.2.0, =1.1.0b1, =0.1.33, =0.0.546, =0.2.0b1, =1.5.0, =0.0.5, =0.0.2, =0.1.1, =0.0.2.7, =0.2.0, =0.4.0, =0.6.0 - docfusion 0.1.0 and more Source cves: CVE-2024-8309 Source advisory: OSV:GHSA-45PG-36P6-83V9...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +584 more potentially affected by CVE-2024-8309 via langchain (>=0.0.27, <=0.2.0rc2)

langchain PYPI version =0.0.27, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.52 and more Source cves: CVE-2024-8309 Source advisory: GHSA-45PG-36P6-83V9...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +584 more potentially affected by CVE-2024-8309 via langchain (>=0.0.27, <=0.2.0rc2)

langchain PYPI version =0.0.27, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.52 and more Source cves: CVE-2024-8309 Source advisory: OSV:GHSA-45PG-36P6-83V9...

GHSA-45PG-36P6-83V9 Langchain SQL Injection vulnerability

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tenant securit...

@langchain/community SQL Injection vulnerability

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all...

GHSA-HC5W-C9F8-9CC4 Langchain Path Traversal vulnerability

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The vulnerability is exploited through the...

CVE-2024-8309

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tenant securit...

CVE-2024-7774

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The vulnerability is exploited through the...

PYSEC-2024-114

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all...