A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version
    0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing
    text files, read `.txt` files, and delete files. The vulnerability is exploited through the
    `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.
    (CVE-2024-7774)

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a   path traversal vulnerability which exists in the `getFullPath` method. This vulnerability allows attackers   to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete   files. The vulnerability is exploited through the `setFileContent`,  `getParsedFile`, and `mdelete`   methods, which do not properly sanitize user input.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
458794	Echo: langchain: security update to 0.2.19	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458794	Echo: langchain: security update to 0.2.19	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
415635	SCA: security update for langchain (GHSA-hc5w-c9f8-9cc4)	Tenable Cloud Security	SCA Checks	Local	medium
415635	SCA: security update for langchain (GHSA-hc5w-c9f8-9cc4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
213566	LangChain < 0.2.5 Arbitrary File Write	Nessus	Artificial Intelligence	Local	critical

Detections

Analytics

CVE-2024-7774

medium

Tenable Plugins

medium

medium

medium

medium

critical