critique
CVE-2024-8309
langchain: SQL Injection in langchain-ai/langchain
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Red Hat4.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (faible), Red Hat (faible).
Description
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | langchain, langchain-community | 0.2.0 et 1 autres |
| seal pip::Seal Security Database | langchain, seal-langchain | 0.0.279+sp999, 0.0.281+sp999, 0.0.287+sp999, 0.0.288+sp999, 0.0.289+sp999, 0.0.290+sp999, 0.0.297+sp999, 0.0.298+sp999, 0.0.299+sp999, 0.0.300+sp999, 0.0.301+sp999, 0.0.302+sp999, 0.0.303+sp999 |
Afficher les 4 entrées de 2 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | langchain | 0.2.0 |
| pip::GitHub Security Advisory pip | langchain-community | 0.2.19 |
| seal pip::Seal Security Database | langchain | 0.0.279+sp999, 0.0.281+sp999, 0.0.287+sp999, 0.0.288+sp999, 0.0.289+sp999, 0.0.290+sp999, 0.0.297+sp999, 0.0.298+sp999, 0.0.299+sp999, 0.0.300+sp999, 0.0.301+sp999, 0.0.302+sp999, 0.0.303+sp999 |
| seal pip::Seal Security Database | seal-langchain | 0.0.279+sp999, 0.0.281+sp999, 0.0.287+sp999, 0.0.288+sp999, 0.0.289+sp999, 0.0.290+sp999, 0.0.297+sp999, 0.0.298+sp999, 0.0.299+sp999, 0.0.300+sp999, 0.0.301+sp999, 0.0.302+sp999, 0.0.303+sp999 |
Références
- https://access.redhat.com/security/cve/CVE-2024-8309
- https://api.python.langchain.com/en/latest/chains/langchain.chains.graph_qa.cypher.GraphCypherQAChain.html
- https://github.com/langchain-ai/langchain
- https://github.com/langchain-ai/langchain/commit/64c317eba05fbac0c6a6fc5aa192bc0d7130972e
- https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-115.yaml
- https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5
- https://nvd.nist.gov/vuln/detail/CVE-2024-8309