mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-01 11:11:27 +00:00
32 lines
1.7 KiB
JSON
32 lines
1.7 KiB
JSON
{
|
|
"id": "CVE-2024-28088",
|
|
"sourceIdentifier": "cve@mitre.org",
|
|
"published": "2024-03-04T00:15:47.017",
|
|
"lastModified": "2024-03-13T21:16:00.380",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution. (A patch is available as of release 0.1.29 of langchain-core.)"
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "LangChain hasta 0.1.10 permite el Directory Traversal ../ por parte de un actor que puede controlar la parte final del par\u00e1metro de ruta en una llamada load_chain. Esto omite el comportamiento previsto de cargar configuraciones solo desde el repositorio GitHub hwchase17/langchain-hub. El resultado puede ser la divulgaci\u00f3n de una clave API para un servicio en l\u00ednea de modelo de lenguaje grande o la ejecuci\u00f3n remota de c\u00f3digo."
|
|
}
|
|
],
|
|
"metrics": {},
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md",
|
|
"source": "cve@mitre.org"
|
|
},
|
|
{
|
|
"url": "https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py",
|
|
"source": "cve@mitre.org"
|
|
},
|
|
{
|
|
"url": "https://github.com/langchain-ai/langchain/pull/18600",
|
|
"source": "cve@mitre.org"
|
|
}
|
|
]
|
|
} |