File System Exposure Vulnerability in Langchain Core by Langchain AI

CVE-2024-10940

What is CVE-2024-10940?

A vulnerability in Langchain Core allows unauthorized users to access arbitrary files within the host’s file system, impacting versions >=0.1.17 and below 0.1.53, as well as >=0.2.0 and below 0.2.43, and >=0.3.0 and below 0.3.15. This issue arises from a flaw in the way 'ImagePromptTemplate' and 'ChatPromptTemplate' are instantiated with user-provided paths, potentially leading to the exposure of sensitive data if these templates are improperly handled. Appropriate measures should be taken to secure your applications from unauthorized file access.

References