A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all
    versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits
    unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches
    in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete
    nodes and relationships without proper authorization, extract sensitive data, disrupt services, access
    data across different tenants, and compromise the integrity of the database. (CVE-2024-7042)

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a prompt injection vulnerability in the GraphCypherQAChain class which leads to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
464482	Echo: @langchain/community: security update to 0.3.3	Tenable Cloud Security	Echo Local Security Checks	Local	low
464482	Echo: @langchain/community: security update to 0.3.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
411514	SCA: security update for @langchain/community (GHSA-6m59-8fmv-m5f9)	Tenable Cloud Security	SCA Checks	Local	low
411514	SCA: security update for @langchain/community (GHSA-6m59-8fmv-m5f9)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
213559	LangChain < 0.2.5 SQLi through Prompt Injection	Nessus	Artificial Intelligence	Local	critical

Detections

Analytics

CVE-2024-7042

low

Tenable Plugins

low

low

low

low

critical