Langchain Path Traversal vulnerability

Description

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files.

Recommendation

Update the langchain package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.19
• Patched version(s): 0.2.19

References

• GHSA-hc5w-c9f8-9cc4
• huntr.com
• CVE-2024-7774
• CWE-22
• CWE-29
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170
• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
• Jan path traversal vulnerability - @janhq/core - CVE-2024-36858
• Jan path traversal vulnerability - CVE-2024-37273

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

langchain