CVE-2024-28088: Path Traversal
LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28088?
CVE-2024-28088 is classified as a medium severity vulnerability.
How do I fix CVE-2024-28088?
To mitigate CVE-2024-28088, upgrade to langchain-core version 0.1.30 or langchain version 0.0.339.
What does CVE-2024-28088 allow an attacker to do?
CVE-2024-28088 allows an attacker to perform directory traversal attacks that can lead to information disclosure.
Which versions of LangChain are affected by CVE-2024-28088?
CVE-2024-28088 affects versions of LangChain up to and including 0.1.12.
Is CVE-2024-28088 a local or remote vulnerability?
CVE-2024-28088 is a remote vulnerability that can be exploited by an attacker with control over the path parameter.