CVE-2024-21513

Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if the...

ROS-20250203-08

Vulnerability in numexpr library of framework for creating applications based on combining languages and models LangChain is related to incorrect code generation control. LangChain models is related to improper code generation control. Exploitation of the vulnerability could allow an attacker...

Malicious code in auth0-langchain-rag-js (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45456ae9e475bcf705080fa16f34aebd7095a7aae6490e2b0a570ecb0b36e27c Any computer that has this package installed or running should be considered...

MAL-2025-635 Malicious code in auth0-langchain-rag-js (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45456ae9e475bcf705080fa16f34aebd7095a7aae6490e2b0a570ecb0b36e27c Any computer that has this package installed or running should be considered...

LangChain < 0.2.5 SQLi through Prompt Injection

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a prompt injection vulnerability in the GraphCypherQAChain class which leads to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service DoS...

LangChain < 0.2.5 SQLi through Prompt Injection

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a vulnerability in the GraphCypherQAChain class which allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial ...

LangChain < 0.1.5 SSRF

The version of LangChain installed on the remote host is prior to 0.1.5. It is, therefore, affected by a Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component of langchain. The vulnerability arises because the Web Research Retriever does not restrict reques...

LangChain < 0.2.5 DoS

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a Denial-of-Service DoS vulnerability in the SitemapLoader class. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion...

LangChain < 0.1.0 SSRF

The version of LangChain installed on the remote host is prior to 0.1.0. It is, therefore, affected by a SSRF vulnerability. An attacker in control of the contents of 'https://example.com' could place a malicious HTML file in there with links like 'https://example.completely.different/myfile.html...

LangChain < 0.0.27 SSRF

The version of LangChain installed on the remote host is prior to 0.0.27. It is, therefore, affected by a server-side request forgery SSRF vulnerability in the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. Note that Nessus...

LangChain < 0.1.35 XXE

The version of LangChain installed on the remote host is prior to 0.1.35. It is, therefore, affected by a XML External Entity XXE vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers o...

LangChain < 0.2.5 Arbitrary File Write

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a path traversal vulnerability which exists in the getFullPath method. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt file...

LangChain < 0.2.9 Vulnerability - CVE-2024-5998

The version of LangChain installed on the remote host is prior to 0.2.9. It is, therefore, affected by a deserialization vulnerability in the FAISS.deserializefrombytes function. This can lead to the execution of arbitrary commands via the os.system function. Note that Nessus has not tested for...

PYSEC-2024-115

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tena...

a-data-processing (=0.0.1), ab-data-processing (=0.0.1) +601 more potentially affected by CVE-2024-8309 via langchain (>=0.0.100 <=0.1.9)

langchain PYPI version =0.0.100, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.18, =0.1.5, =0.2.0, =0.7.1 and more Source cves: CVE-2024-8309 Source advisory: OSV:PYSEC-2024-115...

agential (>=0.0.4 <=0.2.1), agenticos (>=0.0.1 <=0.0.3.155020) +223 more potentially affected by CVE-2024-8309 via langchain-community (>=0.2.0 <=0.2.9)

langchain-community PYPI version =0.2.0, =0.0.4, =0.0.1, =0.0.1, =0.0.13, =0.1.3, =0.3.1.1, =0.2.0, =0.1.0, =1.1.0b1, =0.0.1, =0.1.2, =0.1.5 and more Source cves: CVE-2024-8309 Source advisory: OSV:PYSEC-2024-115...

PYSEC-2024-115

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tena...

Read from host file system via ImagePromptTemplate in langchain-core

Description You can create langchaincore.prompts.ImagePromptTemplate's and by extension the langchaincore.prompts.ChatPromptTemplate's with input variables that make it possible for the prompt template to read any user-specified path from the server file system. If the outputs of the prompt...

GHSA-45PG-36P6-83V9 Langchain SQL Injection vulnerability

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tenant securit...

@aerocorp/cli (=7.0.5), @aj-archipelago/cortex (>=1.1.7 <=1.3.16) +374 more potentially affected by CVE-2024-7042 via @langchain/community (>=0.0.15 <=0.3.29)

@langchain/community NPM version =0.0.15, =1.1.7, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =0.1.0, =1.54.2, =2.0.0-next.2, =1.0.0-alpha.0, =0.2.13-alpha.0, =0.0.28, =0.0.30 and more Source cves: CVE-2024-7042 Source advisory: OSV:GHSA-6M59-8FMV-M5F9...