Vulnerability Description
LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution. (A patch is available as of release 0.1.29 of langchain-core.)
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Langchain | Langchain | < 0.1.12 |
Related Weaknesses (CWE)
References
- https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.mdExploitThird Party Advisory
- https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1dProductThird Party Advisory
- https://github.com/langchain-ai/langchain/pull/18600ExploitIssue TrackingPatch
- https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.mdExploitThird Party Advisory
- https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1dProductThird Party Advisory
- https://github.com/langchain-ai/langchain/pull/18600ExploitIssue TrackingPatch
FAQ
What is CVE-2024-28088?
CVE-2024-28088 is a vulnerability with a CVSS score of 8.1 (HIGH). LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading con...
How severe is CVE-2024-28088?
CVE-2024-28088 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-28088?
Check the references section above for vendor advisories and patch information. Affected products include: Langchain Langchain.