CVE-2024-28088 LangChain directory traversal vulnerability

What is CVE-2024-28088?

CVE-2024-28088 is a high-severity path traversal vulnerability in n/a, published on 3 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution. (A patch is available as of release 0.1.29 of langchain-core.)

Weakness: CWE-22, CWE-31

Which versions are affected by CVE-2024-28088?

6 open source packages ship an affected version, including langchain and langchain-core. It affects 1 product.

Products include Langchain Langchain.

How do I fix CVE-2024-28088?

Upgrade langchain to a fixed version for your release line: 0.0.339 or 0.1.11.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-28088 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28088 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-39631 Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library Critical 9.8
• CVE-2023-36281 langchain vulnerable to arbitrary code execution Critical 9.8
• CVE-2023-38860 LangChain vulnerable to arbitrary code execution Critical 9.8
• CVE-2023-38896 LangChain vulnerable to arbitrary code execution Critical 9.8
• CVE-2023-39659 LangChain vulnerable to arbitrary code execution Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h59x-p739-982c, PYSEC-2024-43, PYSEC-2024-45.