LangChain Code Issues Vulnerabilities

LangChain is used to build applications using LLM through composability. A code issue vulnerability exists in LangChain version 0.1.9, which stems from a Server Request Forgery SSRF vulnerability in the loadlocal function...

CVE-2024-2057: Server-Side Request Forgery (SSRF)

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

PT-2024-18682 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain langchain community version 0.0.26 LangChain version 0.1.9 Description: A critical issue has been found, affecting the load local function in the libs/community/langchain community/retrievers/tfidf.py library of the TFIDFRetriever...

Server-Side Request Forgery

langchain is vulnerable to Server-Side Request Forgery. The vulnerability is due to improper validation of URLs, allowing the inclusion of external links even when preventoutside is set to True, by not adequately comparing the domain of the base URL with the domain of the links being processed...

Arbitrary Code Execution

langchain is vulnerable to Arbitrary Code Execution. The vulnerability is due to lack of prohibition against the command execution attributes in palchain/base.py. The attacker can execute arbitrary commands via these attributes...

LangChain Experimental vulnerable to arbitrary code execution

langchainexperimental aka LangChain Experimental before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not...

GHSA-V8VJ-CV27-HJV8 LangChain Experimental vulnerable to arbitrary code execution

langchainexperimental aka LangChain Experimental before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not...

GHSA-H9J7-5XVC-QHG5 langchain Server-Side Request Forgery vulnerability

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

CVE-2024-27444

langchainexperimental aka LangChain Experimental in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by...

Authentication flaw

langchainexperimental aka LangChain Experimental in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by...

CVE-2024-0243

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

CVE-2024-27444

langchainexperimental aka LangChain Experimental in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by...

LangChain Security Breach

LangChain is used to build applications using LLM through composability. A security vulnerability exists in LangChain versions prior to 0.1.8 that stems from a vulnerability that allows an attacker to bypass and execute arbitrary code via properties in Python code...

CVE-2024-27444

langchainexperimental aka LangChain Experimental in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by...

CVE-2024-27444

The langchain_experimental (LangChain Experimental) component in LangChain before version 0.1.8 (specifically versions before 0.0.52) is vulnerable to arbitrary code execution. The root cause is that certain Python attributes—including ——import” , ——subclasses” , ——builtins” , ——globals” , ——geta...

LangChain Code Issues Vulnerabilities

LangChain is building applications using LLM through composability. LangChain is vulnerable to a code issue. An attacker could use this vulnerability to place a malicious HTML file with a link such as "https://example.completely.different/myfile.html" in it, allowing the crawler to continue...

CVE-2024-27444

langchainexperimental aka LangChain Experimental in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by...

PT-2024-21902

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 0.1.8 langchain experimental versions prior to 0.0.52 Description The issue allows an attacker to bypass a previous fix and execute arbitrary code via certain attributes in Python code, including import , subclasses...

CVE-2024-0243

With the following crawler configuration: An attacker in control of the contents of "https://example.com" could place a malicious HTML file in there with links like "https://example.completely.different/myfile.html" and the crawler would proceed to download that file as well even though...

CVE-2024-0243 Server-side Request Forgery In Recursive URL Loader

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...