CVE-2024-28088

HIGH

LangChain directory traversal vulnerability

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-28088 has a selected CVSS score of 8.1 (high); EIP currently links 1 repository PoC.

Description

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution. (A patch is available as of release 0.1.29 of langchain-core.)

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 7, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

langchain

Browse langchain / langchain

Default status: unknown

CVE ListThrough 0.1.10affected

langchain

Browse PyPI / langchain
GitHub AdvisoryBefore 0.0.339 · Fixed in 0.0.339affected

langchain-core

Browse PyPI / langchain-core
GitHub AdvisoryBefore 0.1.30 · Fixed in 0.1.30affected

Proofs of concept

1

Repository PoCs

GitHublevpachmanov/cve-2024-28088-pocRepository PoCby levpachmanov0Not analyzed6 files

5.9 KiB

GitHub
PoC details

References

8