GHSA-hc5w-c9f8-9cc4

Suggest an improvement
Source
https://github.com/advisories/GHSA-hc5w-c9f8-9cc4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-hc5w-c9f8-9cc4/GHSA-hc5w-c9f8-9cc4.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-hc5w-c9f8-9cc4
Aliases
Related
Published
2024-10-29T15:32:05Z
Modified
2024-11-04T22:12:13.588171Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Langchain Path Traversal vulnerability
Details

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The vulnerability is exploited through the setFileContent, getParsedFile, and mdelete methods, which do not properly sanitize user input.

Database specific 
{
    "nvd_published_at": "2024-10-29T13:15:09Z",
    "cwe_ids": [
        "CWE-22",
        "CWE-29"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-29T19:40:07Z"
}
References

Affected packages

npm / langchain

Package

Name
langchain
View open source insights on deps.dev
Purl
pkg:npm/langchain

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.2.19