CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2024-7774
Critical (9.1) in langchain langchain.js. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in langchain 0.2.19.
A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-22, CWE-29
- Published
- Modified
- Record from
- the NVD, synced
Affected
- langchain:langchain.js
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hc5w-c9f8-9cc4 | npm | langchain | <0.2.19 | 0.2.19 |