Path Traversal

2024-03-0411:56:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

path traversal

load chain function

github repository

api key

remote code execution

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

Percentile

15.5%

JSON

langchain is vulnerable to Path Traversal. This vulnerability is due to a flaw in the load_chain function, allowing an actor to control the final part of the path parameter. This bypasses the intended behavior of loading configurations solely from a specific GitHub repository. The consequence could be the disclosure of an API key or remote code execution.