PYSEC-2024-111 - A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version…

Severity: low · CVSS 3.1 · Published 2024-10-29

A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.

Technologies: langchain (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.1, published 29 October 2024.
Which products and versions are affected?
langchain (PyPI) GIT:introduced=0,fixed=a0fad77d6b569e5872bd4a9d33be0c0785e538a9|ECOSYSTEM:introduced=0.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected?
Check whether you run langchain (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • langchain (PyPI) GIT:introduced=0,fixed=a0fad77d6b569e5872bd4a9d33be0c0785e538a9|ECOSYSTEM:introduced=0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.