A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchain_core.prompts.ImagePromptTemplate's (and by extension langchain_core.prompts.ChatPromptTemplate's) with input variables that can read any user-specified path from the server file system. If the outputs of these prompt templates are exposed to the user, either directly or through downstream model outputs, it can lead to the exposure of sensitive information.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows
    unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to
    create langchain_core.prompts.ImagePromptTemplate's (and by extension
    langchain_core.prompts.ChatPromptTemplate's) with input variables that can read any user-specified path
    from the server file system. If the outputs of these prompt templates are exposed to the user, either
    directly or through downstream model outputs, it can lead to the exposure of sensitive information.
    (CVE-2024-10940)

ID	Name	Product	Family	Type	Severity
463846	Echo: langchain-core: security update to 0.1.53	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463846	Echo: langchain-core: security update to 0.1.53	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
421187	SCA: security update for langchain-core (GHSA-5chr-fjjv-38qv)	Tenable Cloud Security	SCA Checks	Local	medium
421187	SCA: security update for langchain-core (GHSA-5chr-fjjv-38qv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-10940

medium

Tenable Plugins

medium

medium

medium

medium