Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/langchain@0.1.5
Typepypi
Namespace
Namelangchain
Version0.1.5
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.3.1
Latest_non_vulnerable_version0.3.1
Affected_by_vulnerabilities
0
url VCID-23um-cqks-tkc5
vulnerability_id VCID-23um-cqks-tkc5
summary A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
references
0
reference_url https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
1
reference_url https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5
fixed_packages
0
url pkg:pypi/langchain@0.2.0
purl pkg:pypi/langchain@0.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-964p-24u8-yucb
1
vulnerability VCID-fdk5-mhqa-mqgw
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langchain@0.2.0
aliases CVE-2024-8309, PYSEC-2024-115
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-23um-cqks-tkc5
1
url VCID-964p-24u8-yucb
vulnerability_id VCID-964p-24u8-yucb
summary A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
references
0
reference_url https://github.com/langchain-ai/langchain/commit/73c42306745b0831aa6fe7fe4eeb70d2c2d87a82
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://github.com/langchain-ai/langchain/commit/73c42306745b0831aa6fe7fe4eeb70d2c2d87a82
1
reference_url https://huntr.com/bounties/90b0776d-9fa6-4841-aac4-09fde5918cae
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://huntr.com/bounties/90b0776d-9fa6-4841-aac4-09fde5918cae
fixed_packages
0
url pkg:pypi/langchain@0.2.5
purl pkg:pypi/langchain@0.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fdk5-mhqa-mqgw
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langchain@0.2.5
aliases CVE-2024-2965, PYSEC-2024-118
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-964p-24u8-yucb
2
url VCID-fdk5-mhqa-mqgw
vulnerability_id VCID-fdk5-mhqa-mqgw
summary A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
references
0
reference_url https://github.com/langchain-ai/langchainjs/commit/615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://github.com/langchain-ai/langchainjs/commit/615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6
1
reference_url https://huntr.com/bounties/b612defb-1104-4fff-9fef-001ab07c7b2d
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://huntr.com/bounties/b612defb-1104-4fff-9fef-001ab07c7b2d
fixed_packages
0
url pkg:pypi/langchain@0.3.1
purl pkg:pypi/langchain@0.3.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langchain@0.3.1
aliases CVE-2024-7042, PYSEC-2024-114
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fdk5-mhqa-mqgw
3
url VCID-m5uw-4tqc-3ub8
vulnerability_id VCID-m5uw-4tqc-3ub8
summary LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.
references
0
reference_url https://github.com/langchain-ai/langchain
reference_id
reference_type
scores
url https://github.com/langchain-ai/langchain
1
reference_url https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py
reference_id
reference_type
scores
url https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py
2
reference_url https://github.com/langchain-ai/langchain/commit/e1924b3e93d513ca950c72f8e80e1c133749fba5
reference_id
reference_type
scores
url https://github.com/langchain-ai/langchain/commit/e1924b3e93d513ca950c72f8e80e1c133749fba5
3
reference_url https://github.com/langchain-ai/langchain/pull/18600
reference_id
reference_type
scores
url https://github.com/langchain-ai/langchain/pull/18600
4
reference_url https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md
reference_id
reference_type
scores
url https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/langchain-core/PYSEC-2024-45.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/langchain-core/PYSEC-2024-45.yaml
6
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-43.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-43.yaml
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-28088
reference_id CVE-2024-28088
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2024-28088
8
reference_url https://github.com/advisories/GHSA-h59x-p739-982c
reference_id GHSA-h59x-p739-982c
reference_type
scores
url https://github.com/advisories/GHSA-h59x-p739-982c
fixed_packages
0
url pkg:pypi/langchain@0.1.11
purl pkg:pypi/langchain@0.1.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23um-cqks-tkc5
1
vulnerability VCID-964p-24u8-yucb
2
vulnerability VCID-fdk5-mhqa-mqgw
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langchain@0.1.11
aliases CVE-2024-28088, GHSA-h59x-p739-982c, PYSEC-2024-43, PYSEC-2024-45
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-m5uw-4tqc-3ub8
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/langchain@0.1.5