PyPI: langchain-community
CVE-2024-8309
Safety vulnerability ID: SFTY-20241029-31535
Safety legacy ID: pyup.io-73959
Affected versions of langchain-ai/langchain are vulnerable to SQL injection through GraphCypherQAChain class. This vulnerability allows attackers to manipulate database queries via malicious input in prompts, potentially leading to unauthorized data access, manipulation, and cross-tenant data breaches. The vulnerability exists in the query processing logic of GraphCypherQAChain where user input is not properly sanitized. Successfully exploiting this requires access to the API endpoint.
Overview
Langchain SQL Injection vulnerability
Advisory
Affected versions of langchain-ai/langchain are vulnerable to SQL injection through GraphCypherQAChain class. This vulnerability allows attackers to manipulate database queries via malicious input in prompts, potentially leading to unauthorized data access, manipulation, and cross-tenant data breaches. The vulnerability exists in the query processing logic of GraphCypherQAChain where user input is not properly sanitized. Successfully exploiting this requires access to the API endpoint.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20241029-31535/CVE-2024-8309
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8309
- https://github.com/advisories/GHSA-45pg-36p6-83v9
- https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
- https://nvd.nist.gov/vuln/detail/CVE-2024-8309
- https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
- https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-115.yaml
- https://github.com/langchain-ai/langchain/commit/64c317eba05fbac0c6a6fc5aa192bc0d7130972e
- https://github.com/advisories/GHSA-45pg-36p6-83v9
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more