CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

CVE-2024-28088

Summary: CVE-2024-28088 affects LangChain prior to 0.1.29. Through the load_chain call, an attacker who can control the final segment of the path can cause directory traversal ("....") and bypass loading configurations from the langchain-hub repo. This can lead to disclosure of secrets (e.g., API...

CVE-2024-0968

CVE-2024-0968 entry is rejected/not used and not an active vulnerability.

Number withdrawn

Chat LangChain is a locally hosted chatbot implementation dedicated to answering questions via LangChain documents. This CVE number has been withdrawn...

PT-2024-15948 · Langchain Ai · Chat-Langchain

Name of the Vulnerable Software and Affected Versions: langchain-ai/chat-langchain versions prior to 0.0.0 Description: The issue is related to Cross-site Scripting XSS - DOM. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents wher...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +133 more potentially affected by CVE-2024-2057 via langchain-community (>=0.0.1, <=0.0.25)

langchain-community PYPI version =0.0.1, =0.0.6.dev1, =0.0.1, =0.0.1, =0.2.0, =0.1.0, =0.1.5, =0.0.13, =0.0.1, =0.0.4 and more Source cves: CVE-2024-2057 Source advisory: OSV:PYSEC-2024-278...

PYSEC-2024-278

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

PYSEC-2024-278

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

Server side request forgery (ssrf)

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057 LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057

CVE-2024-2057 affects LangChain langchain_community 0.0.26, specifically the TFIDFRetriever’s load_local in libs/community/langchain_community/retrievers/tfidf.py. The vulnerability enables server-side request forgery (SSRF) and is exploitable remotely; public disclosure exists. Upgrading to 0.0....

CVE-2024-2057 LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057 LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

CVE-2024-2057: Server-Side Request Forgery (SSRF)

A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It ...

PT-2024-18682 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain langchain community version 0.0.26 LangChain version 0.1.9 Description: A critical issue has been found, affecting the load local function in the libs/community/langchain community/retrievers/tfidf.py library of the TFIDFRetriever...

LangChain Code Issues Vulnerabilities

LangChain is used to build applications using LLM through composability. A code issue vulnerability exists in LangChain version 0.1.9, which stems from a Server Request Forgery SSRF vulnerability in the loadlocal function...

Server-Side Request Forgery

langchain is vulnerable to Server-Side Request Forgery. The vulnerability is due to improper validation of URLs, allowing the inclusion of external links even when preventoutside is set to True, by not adequately comparing the domain of the base URL with the domain of the links being processed...