PT-2024-40897 · Unknown · Langchainjs

Published 2024-10-29 · Updated 2024-10-29

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions langchainjs version 0.2.5

Description A path traversal issue exists, allowing attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. This is exploited through the setFileContent, getParsedFile, and mdelete methods, which do not properly sanitize user input, specifically through the getFullPath method.

Recommendations For version 0.2.5, consider disabling the getFullPath method until a patch is available, and restrict access to the setFileContent, getParsedFile, and mdelete methods to minimize the risk of exploitation. Avoid using these methods with unsanitized user input until the issue is resolved.

Fix

Related Identifiers

PYSEC-2024-111

Affected Products

Langchainjs

References · 3

• https://osv.dev/vulnerability/PYSEC-2024-111 · Vendor Advisory
• https://github.com/langchain-ai/langchainjs/commit/a0fad77d6b569e5872bd4a9d33be0c0785e538a9 · Note
• https://huntr.com/bounties/8fe40685-b714-4191-af7a-3de5e5628cee · Note