Langchain Path Traversal vulnerability

Description

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files.

Recommendation

Update the langchain package to the latest compatible version. Followings are version details:

Affected version(s): < 0.2.19
Patched version(s): 0.2.19

References

GHSA-hc5w-c9f8-9cc4
huntr.com
CVE-2024-7774
CWE-22
CWE-29
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Langchain Path Traversal vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
Jan path traversal vulnerability - @janhq/core - CVE-2024-36858
Jan path traversal vulnerability - CVE-2024-37273

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated November 01, 2024