16 matches found
brad-agent (>=0.1.33, <=0.1.34) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.1.1)
langchain-nvidia-ai-endpoints PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - brad-agent =0.1.33, =0.1.34 Source cves: unknown CVE Source advisory: OSV:GHSA-G28H-2CMM-RJ9X...
nvidia-nat-langchain (>=1.4.0a20260103, <=1.5.0a20260122), nvidia-pipecat (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (1.0.4)
langchain-nvidia-ai-endpoints PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - nvidia-nat-langchain =1.4.0a20260103, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory:...
langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...
mindsdb (>=25.3.4.1, <=25.9.3rc1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.3)
langchain-nvidia-ai-endpoints PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - mindsdb =25.3.4.1, =25.9.3rc1 Source cves: unknown CVE Source advisory: OSV:GHSA-G28H-2CMM-RJ9X...
vss-ctx-rag (>=0.5.0, <=0.5.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.7)
langchain-nvidia-ai-endpoints PYPI version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - vss-ctx-rag =0.5.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-G28H-2CMM-RJ9X...
nvidia-nat-langchain (>=1.4.0a20260103, <=1.5.0a20260122), nvidia-pipecat (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (1.0.4)
langchain-nvidia-ai-endpoints PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - nvidia-nat-langchain =1.4.0a20260103, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory:...
GHSA-G28H-2CMM-RJ9X langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...
nvidia-nat-langchain (>=1.4.0a20260103, <=1.5.0a20260122), nvidia-pipecat (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (1.0.4)
langchain-nvidia-ai-endpoints PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - nvidia-nat-langchain =1.4.0a20260103, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory:...
aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +2 more potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.9)
langchain-nvidia-ai-endpoints PYPI version 0.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - aiagents4pharma =0.0.0, =1.49.1 - aiagents4pharma-ansh 0.0.0 - aiagents4pharma-anshh 0.0.0 -...
llm-checks-common-functions (>=1.0.0, <=1.1.0) potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.2.2)
langchain-nvidia-ai-endpoints PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - llm-checks-common-functions =1.0.0, =1.1.0 Source cves: unknown CVE Source advisory:...
Directory Traversal
Overview langchain-nvidia-ai-endpoints is an An integration package connecting NVIDIA AI Endpoints and LangChain Affected versions of this package are vulnerable to Directory Traversal via the urltob64string function in utils.py, which previously accepted local filesystem paths as image inputs fo...
aiqtoolkit-langchain (>=1.1.0a20250429, <=1.2.0rc4), gfmrag (>=0.1.3, <=1.0.0) +9 more potentially affected by unknown CVE via langchain-nvidia-ai-endpoints (0.3.19)
langchain-nvidia-ai-endpoints PYPI version 0.3.19 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-nvidia-ai-endpoints and may be impacted: - aiqtoolkit-langchain =1.1.0a20250429, =0.1.3, =0.1.0, =0.1.1, =1.0.0, =0.5.15, =0.1.7, =24.12.0.dev1,...
PT-2026-105510
Summary langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model VLM requests. If an application passed attacker-controlled image input to ChatNVIDIA or VLM reranking APIs, an attacker could cause files readable by the applicati...
Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
At startup, Claude Code constructed a shell command that interpolated the value of git config user.email from the current workspace. If an attacker controlled the repository’s Git config e.g., via a malicious .git/config and set user.email to a crafted payload, the unescaped interpolation could...
CVE-2025-23260
NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...
