crítica
CVE-2024-8309
langchain: SQL Injection in langchain-ai/langchain
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Red Hat4.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (baja), Red Hat (baja).
Descripción
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | langchain, langchain-community | 0.2.0 y 1 más |
| seal pip::Seal Security Database | langchain, seal-langchain | 0.0.279+sp999, 0.0.281+sp999, 0.0.287+sp999, 0.0.288+sp999, 0.0.289+sp999, 0.0.290+sp999, 0.0.297+sp999, 0.0.298+sp999, 0.0.299+sp999, 0.0.300+sp999, 0.0.301+sp999, 0.0.302+sp999, 0.0.303+sp999 |
Mostrar las 4 entradas de 2 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| pip::GitHub Security Advisory pip | langchain | 0.2.0 |
| pip::GitHub Security Advisory pip | langchain-community | 0.2.19 |
| seal pip::Seal Security Database | langchain | 0.0.279+sp999, 0.0.281+sp999, 0.0.287+sp999, 0.0.288+sp999, 0.0.289+sp999, 0.0.290+sp999, 0.0.297+sp999, 0.0.298+sp999, 0.0.299+sp999, 0.0.300+sp999, 0.0.301+sp999, 0.0.302+sp999, 0.0.303+sp999 |
| seal pip::Seal Security Database | seal-langchain | 0.0.279+sp999, 0.0.281+sp999, 0.0.287+sp999, 0.0.288+sp999, 0.0.289+sp999, 0.0.290+sp999, 0.0.297+sp999, 0.0.298+sp999, 0.0.299+sp999, 0.0.300+sp999, 0.0.301+sp999, 0.0.302+sp999, 0.0.303+sp999 |
Referencias
- https://access.redhat.com/security/cve/CVE-2024-8309
- https://api.python.langchain.com/en/latest/chains/langchain.chains.graph_qa.cypher.GraphCypherQAChain.html
- https://github.com/langchain-ai/langchain
- https://github.com/langchain-ai/langchain/commit/64c317eba05fbac0c6a6fc5aa192bc0d7130972e
- https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-115.yaml
- https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5
- https://nvd.nist.gov/vuln/detail/CVE-2024-8309