9.8

PYSEC-2024-114: langchain PyPI

CVSS: 9.8v3.1CriticalPublished
Published 29-10-2024Last modified 04-11-2024
Open JSON

Vulnerability summary

PYSEC-2024-114 is a critical (CVSS 9.8) vulnerability in langchain PyPI.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (OSV · Pypi), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 29-10-2024
    PublishedVulnerability first disclosed.
  2. 04-11-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

PyPI1 product
  • langchain< 615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6 | < 0.3.1

1 vendor · 1 product

References

2 links