Langchain Path Traversal vulnerability

Description

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files.

Recommendation

Update the langchain package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.19
• Patched version(s): 0.2.19

References

• GHSA-hc5w-c9f8-9cc4
• huntr.com
• CVE-2024-7774
• CWE-22
• CWE-29
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype Pollution in jquery-deparam - CVE-2021-20087
• files.photo.gallery command injection - CVE-2024-53615
• Potential XSS vulnerability in jQuery - CVE-2020-11023
• mapshaper Path Traversal vulnerability - CVE-2024-1163

Tags:

npm

langchain