@langchain/community SQL Injection vulnerability

Description

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection.

Recommendation

Update the @langchain/community package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.3.3
• Patched version(s): 0.3.3

References

• GHSA-6m59-8fmv-m5f9
• huntr.com
• CVE-2024-7042
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader - CVE-2026-27795
• @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
• Langchain Path Traversal vulnerability - CVE-2024-7774
• squirrelly Code Injection vulnerability - CVE-2024-40453

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Exploiting Server Version Disclosure

Tags:

npm

@langchain/community