Headline
GHSA-h59x-p739-982c: LangChain directory traversal vulnerability
LangChain through 0.1.10 allows …/ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.
LangChain directory traversal vulnerability
Low severity GitHub Reviewed Published Mar 4, 2024 to the GitHub Advisory Database • Updated Mar 6, 2024