CVE-2024-2057: LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery
A vulnerability was found in LangChain langchaincommunity 0.0.26. It has been classified as critical. Affected is the function loadlocal in the library libs/community/langchaincommunity/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2057?
CVE-2024-2057 has been classified as a critical vulnerability.
How do I fix CVE-2024-2057?
To mitigate CVE-2024-2057, it is recommended to update the LangChain langchain_community library to a patched version.
What component is affected by CVE-2024-2057?
The affected component in CVE-2024-2057 is the TFIDFRetriever function load_local in the langchain_community library.
What impact does CVE-2024-2057 have?
CVE-2024-2057 can lead to server-side request forgery vulnerabilities in applications using the affected library.
Which versions of LangChain langchain_community are vulnerable to CVE-2024-2057?
All versions of LangChain langchain_community up to 0.0.26 are vulnerable to CVE-2024-2057.