CVE-2024-28088: LangChain directory traversal vulnerability

LangChain 安全公告 · 来源更新 2024/03/15 07:14

今日摘要使用自己的 API，仅供个人查看

来源摘要

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

阅读原始来源

来源: LangChain 安全公告 · 社区 / 第三方
来源发布: 2024/03/04 08:30
来源更新: 2024/03/15 07:14
首次采集: 2026/09/19 13:00

本文为公开信息索引与摘要，详情及后续变化请以原始来源为准。

CVE-2026-9856: Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `c

来源更新 2026/09/02 02:58国际查看原文

漏洞与安全Transformers 安全公告社区 / 第三方

CVE-2026-5241: huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, inte

来源更新 2026/07/21 20:33国际查看原文

漏洞与安全LangChain 安全公告社区 / 第三方

CVE-2026-55443: LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

## Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting

来源更新 2026/07/09 01:37国际查看原文

漏洞与安全Transformers 安全公告社区 / 第三方

CVE-2026-4372: HuggingFace transformers vulnerable to remote code execution

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` fi

来源更新 2026/07/02 02:00国际查看原文

漏洞与安全LangChain 安全公告社区 / 第三方

CVE-2026-45134: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

## Description The LangSmith SDK's prompt pull methods (`pull_prompt` / `pull_prompt_commit` in Python, `pullPrompt` / `pullPromptCommit` in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain

来源更新 2026/06/09 07:54国际查看原文