LangChain < 0.2.5 DoS

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a Denial-of-Service DoS vulnerability in the SitemapLoader class. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion...

LangChain < 0.2.5 SQLi through Prompt Injection

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a prompt injection vulnerability in the GraphCypherQAChain class which leads to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service DoS...

LangChain < 0.2.5 Arbitrary File Write

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a path traversal vulnerability which exists in the getFullPath method. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt file...

LangChain < 0.2.9 Vulnerability - CVE-2024-5998

The version of LangChain installed on the remote host is prior to 0.2.9. It is, therefore, affected by a deserialization vulnerability in the FAISS.deserializefrombytes function. This can lead to the execution of arbitrary commands via the os.system function. Note that Nessus has not tested for...

LangChain < 0.1.35 XXE

The version of LangChain installed on the remote host is prior to 0.1.35. It is, therefore, affected by a XML External Entity XXE vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers o...

LangChain < 0.2.5 SQLi through Prompt Injection

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a vulnerability in the GraphCypherQAChain class which allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial ...

PYSEC-2024-115

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tena...

PYSEC-2024-115

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tena...

Read from host file system via ImagePromptTemplate in langchain-core

Description You can create langchaincore.prompts.ImagePromptTemplate's and by extension the langchaincore.prompts.ChatPromptTemplate's with input variables that make it possible for the prompt template to read any user-specified path from the server file system. If the outputs of the prompt...

aiagentgraph (>=0.0.1, <=0.0.4a1), apsbot (>=0.2.0, <=0.3.1) +79 more potentially affected by CVE-2024-8309 via langchain-community (>=0.2.0, <=0.2.17)

langchain-community PYPI version =0.2.0, =0.0.1, =0.2.0, =1.1.0b1, =0.1.33, =0.0.546, =0.2.0b1, =1.5.0, =0.0.5, =0.0.2, =0.1.1, =0.0.2.7, =0.2.0, =0.4.0, =0.6.0 - docfusion 0.1.0 and more Source cves: CVE-2024-8309 Source advisory: GHSA-45PG-36P6-83V9...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +583 more potentially affected by CVE-2024-8309 via langchain (>=0.0.27, <=0.2.0rc2)

langchain PYPI version =0.0.27, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.52 and more Source cves: CVE-2024-8309 Source advisory: OSV:GHSA-45PG-36P6-83V9...

10minions-engine (>=0.0.1, <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1) +473 more potentially affected by CVE-2024-7774 via langchain (>=0.0.11, <=0.2.10)

langchain NPM version =0.0.11, =0.0.1, =1.0.0, =0.1.4, =0.0.11, =0.0.0, =0.0.2-alpha, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =2.0.68, =0.1.0, =0.1.4 - @builderbot-plugins/free-gpt 0.0.6-alpha.0 and more Source cves: CVE-2024-7774 Source advisory: OSV:GHSA-HC5W-C9F8-9CC4...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the GraphCypherQAChain class. An attacker can manipulate, delete, or create data, disrupt services, and compromise database integrity by injecting malicious SQL commands into prompts. Note: This vulnerability impac...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +583 more potentially affected by CVE-2024-8309 via langchain (>=0.0.27, <=0.2.0rc2)

langchain PYPI version =0.0.27, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.52 and more Source cves: CVE-2024-8309 Source advisory: GHSA-45PG-36P6-83V9...

aiagentgraph (>=0.0.1, <=0.0.4a1), apsbot (>=0.2.0, <=0.3.1) +79 more potentially affected by CVE-2024-8309 via langchain-community (>=0.2.0, <=0.2.17)

langchain-community PYPI version =0.2.0, =0.0.1, =0.2.0, =1.1.0b1, =0.1.33, =0.0.546, =0.2.0b1, =1.5.0, =0.0.5, =0.0.2, =0.1.1, =0.0.2.7, =0.2.0, =0.4.0, =0.6.0 - docfusion 0.1.0 and more Source cves: CVE-2024-8309 Source advisory: OSV:GHSA-45PG-36P6-83V9...

10minions-engine (>=0.0.1, <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1) +473 more potentially affected by CVE-2024-7774 via langchain (>=0.0.11, <=0.2.10)

langchain NPM version =0.0.11, =0.0.1, =1.0.0, =0.1.4, =0.0.11, =0.0.0, =0.0.2-alpha, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =2.0.68, =0.1.0, =0.1.4 - @builderbot-plugins/free-gpt 0.0.6-alpha.0 and more Source cves: CVE-2024-7774 Source advisory: GHSA-HC5W-C9F8-9CC4...

assistant (>=1.1.0b1, <=1.2.1b1), autonomous-agent (0.0.1) +60 more potentially affected by CVE-2024-8309 via langchain-community (>=0.2.5, <=0.2.17)

langchain-community PYPI version =0.2.5, =1.1.0b1, =0.0.549, =0.2.0b1, =1.5.0, =0.1.1, =0.0.2.7, =0.2.0, =0.4.0, =0.1.3, =0.1.3, =0.1.0, =0.1.3, =0.1.7 and more Source cves: CVE-2024-8309 Source advisory: SNYK:PYTHON-LANGCHAINCOMMUNITY-8310287...

@langchain/community SQL Injection vulnerability

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all...

@aerocorp/cli (7.0.5), @aj-archipelago/cortex (>=1.1.7, <=1.3.16) +328 more potentially affected by CVE-2024-7042 via @langchain/community (>=0.0.15, <=0.3.2)

@langchain/community NPM version =0.0.15, =1.1.7, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =2.0.0-next.2, =1.0.0-alpha.0, =0.2.13-alpha.0, =0.0.28, =0.0.11, =0.0.18 and more Source cves: CVE-2024-7042 Source advisory: OSV:GHSA-6M59-8FMV-M5F9...

@aerocorp/cli (7.0.5), @aj-archipelago/cortex (>=1.1.7, <=1.3.16) +328 more potentially affected by CVE-2024-7042 via @langchain/community (>=0.0.15, <=0.3.2)

@langchain/community NPM version =0.0.15, =1.1.7, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =2.0.0-next.2, =1.0.0-alpha.0, =0.2.13-alpha.0, =0.0.28, =0.0.11, =0.0.18 and more Source cves: CVE-2024-7042 Source advisory: GHSA-6M59-8FMV-M5F9...