PT-2025-4294 · Unknown · Langchain4J-Aideepin

Moyangzhan · Published 2025-01-06 · Updated 2025-01-06 · CVE-2025-21604

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LangChain4j-AIDeepin versions prior to 3.5.0

Description LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to version 3.5.0, it used MD5 to hash files, which may cause file upload conflicts.

Recommendations For versions prior to 3.5.0, update to version 3.5.0 to resolve the issue. As a temporary workaround, consider avoiding the use of MD5 hashing for file uploads until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-328

Related Identifiers

CVE-2025-21604

GHSA-CV5R-73VF-8X7V

Affected Products

Langchain4J-Aideepin

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21604.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-21604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21604 · Security Note
• https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a · Note
• https://github.com/moyangzhan/langchain4j-aideepin/security/advisories/GHSA-cv5r-73vf-8x7v · Note
• https://t.me/cvedetector/14365 · Telegram Post
• https://twitter.com/CVEnew/status/1876295888043483318 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1876314116379361606 · Twitter Post