CVE-2024-8309: SQL Injection in langchain-ai/langchain
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8309?
CVE-2024-8309 is rated as a high-severity vulnerability due to the potential for unauthorized data manipulation and denial of service.
How do I fix CVE-2024-8309?
To fix CVE-2024-8309, update your langchain package to version 0.2.19 or later.
What happens if I am affected by CVE-2024-8309?
If you are affected by CVE-2024-8309, your application may be vulnerable to SQL injection attacks leading to serious data integrity and security issues.
Which versions of langchain are affected by CVE-2024-8309?
CVE-2024-8309 affects langchain version 0.2.5 and older versions.
Is CVE-2024-8309 exploitable in production environments?
Yes, CVE-2024-8309 is exploitable in production environments, especially where unvalidated user inputs are processed.