GitHub Advisoryadvisory · npm

GHSA-hc5w-c9f8-9cc4 Langchain Path Traversal vulnerability

MEDIUM Published 2024-10-29 Modified 2024-11-01 Official page ↗
Aliases
CVE-2024-7774
Ecosystem
npm
Packages
langchain
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-22, CWE-29
Reviewed
2024-10-29

Affected packages

• npm langchain: < 0.2.19 → fixed in 0.2.19

Description

A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.

Related

Alias · CVE (1)

  • CVE-2024-7774 A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-29 Path Traversal: '\..\filename' weakness

References