Advisoriesby IbisLangChainGHSA-6m59-8fmv-m5f9
@langchain/community SQL Injection vulnerability
Fix: upgrade to 0.3.3 or later
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| @langchain/community npm | < 0.3.3 | 0.3.3 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- CVE-2024-7042
More LangChain advisories
All LangChain
Langchain SQL Injection vulnerabilityCVE-2024-8309fixed in 0.2.0 +1Langchain Path Traversal vulnerabilityCVE-2024-7774fixed in 0.2.19LangChain Experimental Eval Injection vulnerabilityCVE-2024-46946no fix yetLangChain pickle deserialization of untrusted dataCVE-2024-5998fixed in 0.2.4langchain-experimental vulnerable to Arbitrary Code ExecutionCVE-2024-21513fixed in 0.0.21langchain_experimental Code Execution via Python REPL accessCVE-2024-38459fixed in 0.0.61