Executive brief
LangChain's NVIDIA AI endpoints library, used to integrate vision language models into applications, accepts local file paths as image inputs. If an application allows untrusted users to control image URLs or metadata passed to the ChatNVIDIA or NVIDIARerank APIs, an attacker can read arbitrary files accessible to the application process and extract their contents through the model endpoint. This exposes sensitive configuration files, credentials, or other confidential data stored on the server.
Technical details
The vulnerability is a path traversal / improper input validation issue (CWE-22) in the VLM image input handling of langchain-nvidia-ai-endpoints versions ≤ 1.4.1. The library accepts raw local filesystem paths as image inputs without validation, allowing an attacker who controls image URLs or document metadata to specify arbitrary file paths. When the ChatNVIDIA or NVIDIARerank APIs process these paths, they read the file contents and include them in the outbound request to the NVIDIA/NIM model endpoint, exfiltrating the data. The attack requires network access and no authentication or user interaction. Patch 1.4.2 rejects filesystem paths and only accepts remote URLs, base64 data URIs, or approved file IDs.
Affected products
- LangChain langchain-nvidia-ai-endpoints <= 1.4.1
Timeline
- 2026-06-23: disclosed
- 2026-06-23: patched: Version 1.4.2 released
- 2026-09-24: advisory