CVE-2024-8309: Langchain SQL Injection vulnerability

LangChain 安全公告 · 来源更新 2024/11/13 03:58

今日摘要使用自己的 API，仅供个人查看

来源摘要

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

阅读原始来源

来源: LangChain 安全公告 · 社区 / 第三方
来源发布: 2024/10/29 23:32
来源更新: 2024/11/13 03:58
首次采集: 2026/09/19 13:00

本文为公开信息索引与摘要，详情及后续变化请以原始来源为准。

CVE-2026-9856: Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `c

来源更新 2026/09/02 02:58国际查看原文

漏洞与安全Transformers 安全公告社区 / 第三方

CVE-2026-5241: huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, inte

来源更新 2026/07/21 20:33国际查看原文

漏洞与安全LangChain 安全公告社区 / 第三方

CVE-2026-55443: LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

## Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting

来源更新 2026/07/09 01:37国际查看原文

漏洞与安全Transformers 安全公告社区 / 第三方

CVE-2026-4372: HuggingFace transformers vulnerable to remote code execution

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` fi

来源更新 2026/07/02 02:00国际查看原文

漏洞与安全LangChain 安全公告社区 / 第三方

CVE-2026-45134: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

## Description The LangSmith SDK's prompt pull methods (`pull_prompt` / `pull_prompt_commit` in Python, `pullPrompt` / `pullPromptCommit` in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain

来源更新 2026/06/09 07:54国际查看原文