PT-2024-38931 · Langchain Ai · Langchain-Community+1

Published 2024-10-29 · Updated 2026-06-15 · CVE-2024-8309

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain version 0.2.5 langchain-ai/langchain-community version 0.2.5

Description: A vulnerability in the GraphCypherQAChain class allows for SQL injection through prompt injection, leading to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

Recommendations: For langchain-ai/langchain version 0.2.5, consider disabling the GraphCypherQAChain class until a patch is available to prevent SQL injection attacks. For langchain-ai/langchain-community version 0.2.5, consider disabling the GraphCypherQAChain class until a patch is available to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2024-8309

GHSA-45PG-36P6-83V9

PYSEC-2024-115

Affected Products

Langchain

Langchain-Community

References · 13

• 🔥 https://github.com/liadlevy/CVE-2024-8309 · Exploit
• 🔥 https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5 · Exploit
• https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255 · Patch
• https://osv.dev/vulnerability/GHSA-45pg-36p6-83v9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8309 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8309 · Vendor Advisory
• https://github.com/langchain-ai/langchain · Note
• https://github.com/langchain-ai/langchain/commit/64c317eba05fbac0c6a6fc5aa192bc0d7130972e · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-115.yaml · Note
• https://twitter.com/GotoNathan/status/2066597448131219780 · Twitter Post
• https://github.com/advisories/GHSA-45pg-36p6-83v9 · Note
• https://t.me/cvedetector/9314 · Telegram Post