CVE-2024-3571

Langchain CVE-2024-3571 affects langchain-ai/langchain LocalFileStore, where pathnames in mset/mget are not adequately sanitized, enabling path traversal to read/write arbitrary filesystem locations. This can lead to information disclosure and potentially remote code execution. Connected document...

CVE-2024-3571

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory 'Path Traversal' in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to...

CVE-2024-3571: Improper Limitation of a Pathname to a Restricted Directory

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory 'Path Traversal' in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to...

LangChain path traversal vulnerability

LangChain is built as an application using LLM through composability. LangChain suffers from a path traversal vulnerability that stems from vulnerability to a path traversal attack, which can be exploited by an attacker to read or write a file anywhere on the filesystem, potentially leading to...

PT-2024-26659

Name of the Vulnerable Software and Affected Versions langchain-ai/langchain affected versions not specified Description langchain-ai/langchain is susceptible to a path traversal issue stemming from insufficient restriction of pathnames within its LocalFileStore functionality. This allows attacke...

XML External Entity (XXE)

langchaincore is vulnerable to XML External Entity XXE. The vulnerability is due to the usage of the etree module from the XML parser within the XMLOutputParser component of LangChain, allowing attackers to inject malicious input into the XMLOutputParser...

LangChain's XMLOutputParser vulnerable to XML Entity Expansion

The XMLOutputParser in LangChain uses the etree module from the XML parser in the standard python library which has some XML vulnerabilities; see: https://docs.python.org/3/library/xml.html This primarily affects users that combine an LLM or agent with the XMLOutputParser and expose the component...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +151 more potentially affected by CVE-2024-1455 via langchain-core (>=0.0.1, <=0.1.33)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.8.0, =0.0.1, =0.0.1, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.0.14 and more Source cves: CVE-2024-1455 Source advisory: OSV:GHSA-Q84M-RMW3-4382...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +151 more potentially affected by CVE-2024-1455 via langchain-core (>=0.0.1, <=0.1.33)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.8.0, =0.0.1, =0.0.1, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.0.14 and more Source cves: CVE-2024-1455 Source advisory: GHSA-Q84M-RMW3-4382...

GHSA-Q84M-RMW3-4382 LangChain's XMLOutputParser vulnerable to XML Entity Expansion

The XMLOutputParser in LangChain uses the etree module from the XML parser in the standard python library which has some XML vulnerabilities; see: https://docs.python.org/3/library/xml.html This primarily affects users that combine an LLM or agent with the XMLOutputParser and expose the component...

CVE-2024-1455 Billion Laughs Attack leading to DoS in langchain-ai/langchain

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

CVE-2024-1455 Billion Laughs Attack leading to DoS in langchain-ai/langchain

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +151 more potentially affected by CVE-2024-1455 via langchain-core (>=0.0.1, <=0.1.33)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.8.0, =0.0.1, =0.0.1, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.0.14 and more Source cves: CVE-2024-1455 Source advisory: MEND:CVE-2024-1455...

CVE-2024-1455

CVE-2024-1455 concerns a Billion Laughs Attack (XML External Entity) affecting the langchain-ai/langchain repository. Connected sources indicate the vulnerability centers on the XMLOutputParser using the standard Python etree XML parser, enabling an attacker to nest entities in XML to exhaust CPU...

CVE-2024-1455

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

CVE-2024-1455 Billion Laughs Attack leading to DoS in langchain-ai/langchain

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

LangChain security vulnerabilities

LangChain builds applications using LLM through composability. A security vulnerability exists in LangChain that originates from allowing an attacker to generate a malicious payload for the parser via LLM, thereby compromising the availability of the service...

PT-2024-18059

Name of the Vulnerable Software and Affected Versions LangChain affected versions not specified Description The issue concerns the XMLOutputParser in LangChain, which utilizes the etree module from the XML parser in the standard Python library. This library has some XML vulnerabilities, making it...

CVE-2024-1455: Improper Restriction of Recursive Entity References in DTDs

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +146 more potentially affected by CVE-2024-28088 via langchain-core (>=0.0.1, <=0.1.28)

langchain-core PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.8.0, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.3.5, =0.4.12 - bisheng-langchain 0.2.3.1 and more Source cves: CVE-2024-28088 Source advisory: GHSA-H59X-P739-982C...