Vulnerability · Published Oct 29, 2024 · Assigned by @huntr_ai

CVE-2024-7774Path Traversal in langchain-ai/langchainjs

Medium 6.5

In plain English

A medium-severity security flaw in langchain-ai/langchainjs from langchain-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)6.5Medium

Exploit odds (30 days)0.6%top 53.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	langchain	0.2.19	GHSA-hc5w-c9f8-9cc4

Affected products (as reported)

Vendor	Product	Versions
langchain-ai	langchain-ai/langchainjs	unspecified – before 0.2.19

Weakness: CWE-29 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References