LangChainGHSA-hc5w-c9f8-9cc4
Langchain Path Traversal vulnerability
Medium6.5CVE-2024-7774 · Published Oct 29, 2024 · updated Aug 7, 2026
A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| langchain npm | < 0.2.19 | 0.2.19 |
Details and references
More LangChain advisories
All LangChain| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 292024 | Langchain SQL Injection vulnerability Low4.9Oct 29, 2024 | Low4.9 | 0.2.0+1 more |
| Oct 292024 | @langchain/community SQL Injection vulnerabilityLow4.9Oct 29, 2024 | Low4.9 | 0.3.3 |
| Sep 192024 | LangChain Experimental Eval Injection vulnerabilityCritical9.8Sep 19, 2024 | Critical9.8 | No fix yet |
| Sep 172024 | LangChain pickle deserialization of untrusted dataHigh5.2Sep 17, 2024 | High5.2 | 0.2.4 |
| Jul 152024 | langchain-experimental vulnerable to Arbitrary Code ExecutionCritical8.5Jul 15, 2024 | Critical8.5 | 0.0.21 |
| Jun 162024 | langchain_experimental Code Execution via Python REPL accessHigh7.8Jun 16, 2024 | High7.8 | 0.0.61 |