PYSEC-2024-45

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/langchain-core/PYSEC-2024-45.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2024-45
Aliases
Published
2024-03-04T00:15:00Z
Modified
2024-03-13T23:56:46.692405Z
Summary
[none]
Details

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution. (A patch is available as of release 0.1.29 of langchain-core.)

References

Affected packages

PyPI / langchain-core

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.11

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13rc1
0.0.13rc2
0.0.13
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10