CodexGuild Knowledge Base

LangChain directory traversal vulnerability

as of Mar 4, 2024 · applies to langchain < 0.0.339; langchain-core >= 0, < 0.1.30 · canonical · codexguild.com/kb/ghsa-h59x-p739-982c · exported 2026-10-11

Canonical as of Mar 4, 2024

LangChain directory traversal vulnerability

Low severity. Affects langchain < 0.0.339; langchain-core >= 0, < 0.1.30. Upgrade to 0.0.339 / 0.1.30 or later.

CVE-2024-28088 / GHSA-h59x-p739-982c · severity: low · PyPI

Affected

langchain < 0.0.339 → fixed in 0.0.339
langchain-core >= 0, < 0.1.30 → fixed in 0.1.30

Details

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

Source: GHSA-h59x-p739-982c — GitHub Advisory Database (CC-BY-4.0).