2024 LangChain — CVE-2024-28088 URI traversal exposed API tokens

2024 Unknown records affected

Data compromised

API tokens; potential RCE

Technical writeup

URI traversal in load_chain, load_prompt, load_agent exposed API tokens. CVE-2024-28088. Also CVE-2023-44467 (PALChain prompt injection), CVE-2023-46229 (SitemapLoader SSRF).

Root cause

Configuration loading flaw; insufficient input validation

References

https://www.toreon.com/cve-2024-28088/
https://www.bankinfosecurity.com/vulnerabilities-in-langchain-genai-could-prompt-data-leak-a-25844