CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

LangChain Security Breach

LangChain builds applications using LLM through composability. A security vulnerability exists in LangChain 0.1.10 and earlier versions that stems from a URI traversal vulnerability when loading configuration files...

CVE-2024-28088: Improper Limitation of a Pathname to a Restricted Directory

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

PT-2024-22256 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain versions 0.1.10 and earlier Description: The issue allows an actor who can control the final part of the path parameter in a load chain call to perform ../ directory traversal. This bypasses the intended behavior of loading...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +148 more potentially affected by CVE-2024-28088 via langchain-core (>=0.0.1, <=0.1.28)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.8.0, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.3.5, =0.4.12 - bisheng-langchain 0.2.3.1 and more Source cves: CVE-2024-28088 Source advisory: MEND:CVE-2024-28088...

CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

CVE-2024-0968

CVE-2024-0968 entry is rejected/not used and not an active vulnerability.

Number withdrawn

Chat LangChain is a locally hosted chatbot implementation dedicated to answering questions via LangChain documents. This CVE number has been withdrawn...

PT-2024-15948 · Langchain Ai · Chat-Langchain

Name of the Vulnerable Software and Affected Versions: langchain-ai/chat-langchain versions prior to 0.0.0 Description: The issue is related to Cross-site Scripting XSS - DOM. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents wher...

CVE-2024-2057

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

PYSEC-2024-278

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

PYSEC-2024-278

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

Server side request forgery (ssrf)

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057

CVE-2024-2057 affects LangChain langchain_community 0.0.26, specifically the TFIDFRetriever’s load_local in libs/community/langchain_community/retrievers/tfidf.py. The vulnerability enables server-side request forgery (SSRF) and is exploitable remotely; public disclosure exists. Upgrading to 0.0....

CVE-2024-2057

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057 LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057 LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057 LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...