affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: langchain-community
    purl: pkg:pypi/langchain-community
  ranges:
  - events:
    - introduced: '0'
    - last_affected: 0.0.26
    type: ECOSYSTEM
  versions:
  - 0.0.1
  - 0.0.10
  - 0.0.11
  - 0.0.12
  - 0.0.13
  - 0.0.14
  - 0.0.15
  - 0.0.16
  - 0.0.17
  - 0.0.18
  - 0.0.19
  - 0.0.1rc1
  - 0.0.1rc2
  - 0.0.2
  - 0.0.20
  - 0.0.21
  - 0.0.22
  - 0.0.23
  - 0.0.24
  - 0.0.25
  - 0.0.26
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.0.8
  - 0.0.9
aliases:
- CVE-2024-2057
details: A vulnerability was found in LangChain langchain_community 0.0.26. It has
  been classified as critical. Affected is the function load_local in the library
  libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever.
  The manipulation leads to server-side request forgery. It is possible to launch
  the attack remotely. The exploit has been disclosed to the public and may be used.
  Upgrading to version 0.0.27 is able to address this issue. It is recommended to
  upgrade the affected component. The identifier of this vulnerability is VDB-255372.
id: PYSEC-2024-278
modified: '2026-05-21T14:54:31.650556Z'
published: '2024-03-01T12:15:48.670Z'
references:
- type: WEB
  url: https://github.com/bayuncao/vul-cve-16/tree/main/PoC.pkl
- type: REPORT
  url: https://vuldb.com/?ctiid.255372
- type: REPORT
  url: https://vuldb.com/?id.255372
- type: FIX
  url: https://github.com/langchain-ai/langchain/pull/18695
- type: PACKAGE
  url: https://github.com/bayuncao/vul-cve-16
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3