id: PYSEC-2024-45
modified: 2024-03-13T23:20:07.486731Z
published: 2024-03-04T00:15:00Z
aliases:
- CVE-2024-28088
- GHSA-h59x-p739-982c
details: LangChain through 0.1.10 allows ../ directory traversal by an actor who is
  able to control the final part of the path parameter in a load_chain call. This
  bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub
  GitHub repository. The outcome can be disclosure of an API key for a large language
  model online service, or remote code execution. (A patch is available as of release
  0.1.29 of langchain-core.)
affected:
- package:
    ecosystem: PyPI
    name: langchain-core
    purl: pkg:pypi/langchain-core
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.1.11
  versions:
  - 0.0.1
  - 0.0.10
  - 0.0.11
  - 0.0.12
  - 0.0.13
  - 0.0.13rc1
  - 0.0.13rc2
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.0.8
  - 0.0.9
  - 0.1.0
  - 0.1.1
  - 0.1.10
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
references:
- type: WEB
  url: https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md
- type: WEB
  url: 
    https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py
- type: WEB
  url: https://github.com/langchain-ai/langchain/pull/18600
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h59x-p739-982c