AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

LangChainGHSA-hc5w-c9f8-9cc4

Langchain Path Traversal vulnerability

LangChain

CVE-2024-7774 · Published Oct 29, 2024 · updated Aug 7, 2026

Medium6.5
Fix: upgrade to 0.2.19 or later
GitHub advisory

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The vulnerability is exploited through the setFileContent, getParsedFile, and mdelete methods, which do not properly sanitize user input.

Affected versions

PackageAffectedFixed in
langchain
npm
< 0.2.190.2.19
Details and references

More LangChain advisories

All LangChain