CVE-2024-1455

CVE-2024-1455 concerns a Billion Laughs Attack (XML External Entity) affecting the langchain-ai/langchain repository. Connected sources indicate the vulnerability centers on the XMLOutputParser using the standard Python etree XML parser, enabling an attacker to nest entities in XML to exhaust CPU...

CVE-2024-1455

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

CVE-2024-1455 Billion Laughs Attack leading to DoS in langchain-ai/langchain

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

PT-2024-18059

Name of the Vulnerable Software and Affected Versions LangChain affected versions not specified Description The issue concerns the XMLOutputParser in LangChain, which utilizes the etree module from the XML parser in the standard Python library. This library has some XML vulnerabilities, making it...

CVE-2024-1455: Improper Restriction of Recursive Entity References in DTDs

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

LangChain 安全漏洞

LangChain builds applications using LLM through composability. A security vulnerability exists in LangChain that originates from allowing an attacker to generate a malicious payload for the parser via LLM, thereby compromising the availability of the service...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +148 more potentially affected by CVE-2024-28088 via langchain-core (>=0.0.1, <=0.1.28)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.8.0, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.3.5, =0.4.12 - bisheng-langchain 0.2.3.1 and more Source cves: CVE-2024-28088 Source advisory: GHSA-H59X-P739-982C...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +148 more potentially affected by CVE-2024-28088 via langchain-core (>=0.0.1, <=0.1.28)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.8.0, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.3.5, =0.4.12 - bisheng-langchain 0.2.3.1 and more Source cves: CVE-2024-28088 Source advisory: OSV:GHSA-H59X-P739-982C...

GHSA-H59X-P739-982C LangChain directory traversal vulnerability

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

agent-actors (0.1.0), agent-lab-sdk (>=0.1.7, <=0.1.16) +314 more potentially affected by CVE-2024-28088 via langchain (>=0.0.27, <=0.0.338)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.0, =0.1.5, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.8, =0.0.1, =0.0.14, =0.0.18 and more Source cves: CVE-2024-28088 Source advisory: GHSA-H59X-P739-982C...

LangChain directory traversal vulnerability

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

PYSEC-2024-45

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +431 more potentially affected by CVE-2024-28088 via langchain (>=0.0.27, <=0.1.10)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.1.0 and more Source cves: CVE-2024-28088 Source advisory: OSV:PYSEC-2024-43...

PYSEC-2024-43

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

PYSEC-2024-43

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

Directory traversal

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

PYSEC-2024-45

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

agentuniverse (>=0.0.6.dev1, <=0.0.7), akasha-terminal (>=0.8.0, <=0.8.5) +39 more potentially affected by CVE-2024-28088 via langchain-core (>=0.0.1, <=0.1.9)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.8.0, =0.3.5, =0.3.16, =0.1.0, =0.0.1, =0.0.1, =0.0.5, =0.4.8, =5.8.0 and more Source cves: CVE-2024-28088 Source advisory: OSV:PYSEC-2024-45...

CVE-2024-28088

Summary: CVE-2024-28088 affects LangChain prior to 0.1.29. Through the load_chain call, an attacker who can control the final segment of the path can cause directory traversal ("....") and bypass loading configurations from the langchain-hub repo. This can lead to disclosure of secrets (e.g., API...