LangChain Resource Management Error Vulnerability

LangChain is the LangChain open source framework for developing applications powered by the Large Language Model LLM. A resource management error vulnerability exists in LangChain because the parsesitemap method, which is responsible for parsing the sitemap and extracting the URL, lacks a mechani...

CVE-2024-3095: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This...

LangChain Code Issues Vulnerabilities

LangChain is an application built using LLM through composability. LangChain has a code issue vulnerability that stems from a server-side request forgery SSRF vulnerability in the Web Research Retriever component...

CVE-2024-2965: Uncontrolled Recursion

A Denial-of-Service DoS vulnerability exists in the SitemapLoader class of the langchain-ai/langchain repository, affecting all versions. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the...

GHSA-CWGG-W6MP-W9HG MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37058

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37058

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37058

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37058

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37058: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

PT-2024-27273

Name of the Vulnerable Software and Affected Versions MLflow versions 2.5.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user's system when interacted with. Recommendations F...

Path Traversal

langchain is vulnerable to Path Traversal. The vulnerability is due to improper pathname validation in the LocalFileStore functionality, which allows an attacker to read or write files anywhere on the filesystem...

GHSA-RGP8-PM28-3759 langchain vulnerable to path traversal

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory 'Path Traversal' in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to...

CVE-2024-3571

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory 'Path Traversal' in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to...

CVE-2024-3571 Path Traversal in langchain-ai/langchain

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory 'Path Traversal' in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to...

CVE-2024-3571

Langchain CVE-2024-3571 affects langchain-ai/langchain LocalFileStore, where pathnames in mset/mget are not adequately sanitized, enabling path traversal to read/write arbitrary filesystem locations. This can lead to information disclosure and potentially remote code execution. Connected document...

CVE-2024-3571: Improper Limitation of a Pathname to a Restricted Directory

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory 'Path Traversal' in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to...

PT-2024-26659

Name of the Vulnerable Software and Affected Versions langchain-ai/langchain affected versions not specified Description langchain-ai/langchain is susceptible to a path traversal issue stemming from insufficient restriction of pathnames within its LocalFileStore functionality. This allows attacke...

LangChain 路径遍历漏洞

LangChain is built as an application using LLM through composability. LangChain suffers from a path traversal vulnerability that stems from vulnerability to a path traversal attack, which can be exploited by an attacker to read or write a file anywhere on the filesystem, potentially leading to...