CVE-2024-7774

CVE-2024-7774 describes a path traversal in langchain-ai/langchainjs v0.2.5. The getFullPath path handling is vulnerable, allowing an attacker to save files anywhere, overwrite text files, read .txt files, and delete files via unsanitized input in getFullPath and related calls (setFileContent, ge...

PT-2024-38931

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain version 0.2.5 langchain-ai/langchain-community version 0.2.5 Description: A vulnerability in the GraphCypherQAChain class allows for SQL injection through prompt injection, leading to unauthorized data manipulation, dat...

LangChain SQL注入漏洞

LangChain is a LangChain open source framework for developing applications powered by the Large Language Model LLM. A SQL injection vulnerability exists in LangChain version 0.2.5, which stems from SQL injection that can be achieved via prompt injection and could lead to unauthorized data...

PT-2024-38042 · Langchain Ai · Langchainjs

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchainjs versions 0.2.5 and later Description: The issue allows for prompt injection, leading to SQL injection, which can result in unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data,...

LangChain < 0.2.9 SSRF

The remote host contains a langchain version that is prior to 0.2.9. It is, therefore, affected by a Server-Side Request Forgery vulnerability in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises...

LangChain < 0.2.4 RCE

The remote host contains a langchain version that is prior to 0.2.4. It is, therefore, affected by a vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain which allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands v...

Eval Injection

LangChain Experimental is vulnerable to Eval Injection. The vulnerability is due to the use of sympy.sympify which relies on eval in the LLMSymbolicMathChain, allowing attackers to execute arbitrary code in versions 0.1.17 through 0.3.0...

GHSA-P2QJ-R53J-H3XJ LangChain Experimental Eval Injection vulnerability

langchainexperimental aka LangChain Experimental 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify which uses eval in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 2023-10-05...

LangChain Experimental Eval Injection vulnerability

langchainexperimental aka LangChain Experimental 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify which uses eval in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 2023-10-05...

CVE-2024-46946

langchainexperimental aka LangChain Experimental 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify which uses eval in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 2023-10-05...

CVE-2024-46946

langchainexperimental aka LangChain Experimental 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify which uses eval in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 2023-10-05...

CVE-2024-46946

CVE-2024-46946 affects langchain_experimental (LangChain Experimental) versions 0.1.17–0.3.0. The issue stems from LLMSymbolicMathChain using sympy.sympify (which calls eval), allowing potential arbitrary code execution. Root cause is in the LLMSymbolicMathChain introduced around 2023-10-05. Impa...

LangChain 安全漏洞

LangChain is the LangChain open source framework for developing applications powered by the Large Language Model LLM. A security vulnerability exists in LangChain versions 0.1.17 through 0.3.0 that originates from a vulnerability that allows an attacker to execute arbitrary code via sympy.sympify...

CVE-2024-46946

langchainexperimental aka LangChain Experimental 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify which uses eval in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 2023-10-05...

CVE-2024-46946

langchainexperimental aka LangChain Experimental 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify which uses eval in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 2023-10-05...

Deserialization Of Untrusted Data

Langchain is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused due to improper deserialization of untrusted pickle data in the FAISS.deserializefrombytes function, which allows execution of arbitrary commands via os.system...

PT-2024-32293

Name of the Vulnerable Software and Affected Versions langchain experimental versions 0.1.17 through 0.3.0 Description The issue allows attackers to execute arbitrary code through sympy.sympify which uses eval in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in a specific commit on...

a-data-processing (=0.0.1), ab-data-processing (=0.0.1) +485 more potentially affected by CVE-2024-5998 via langchain-community (>=0.0.1 <=0.2.2)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.0.1, =0.1.0, =0.0.1, =0.0.18, =0.2.0, =0.0.1, =0.0.2, =0.0.1, =0.0.4a1 - aicat-annotator =0.0.1 and more Source cves: CVE-2024-5998 Source advisory: OSV:GHSA-F2JM-RW3H-6PHG...

a-data-processing (=0.0.1), ab-data-processing (=0.0.1) +346 more potentially affected by CVE-2024-5998 via langchain-community (>=0.0.1 <=0.2.1)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.1.0, =0.0.18, =0.2.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.19.0, =0.30.0 and more Source cves: CVE-2024-5998 Source advisory: SNYK:PYTHON-LANGCHAINCOMMUNITY-11356595...

GHSA-F2JM-RW3H-6PHG LangChain pickle deserialization of untrusted data

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects versions prior to 0.2.4...