Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-8309— SQL Injection in langchain-ai/langchain

Quick assessment

Affected
langchain-ai langchain-ai/langchain
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LangChain是LangChain开源的一个用于开发由大型语言模型 （LLM） 提供支持的应用程序的框架。 LangChain 0.2.5版本存在SQL注入漏洞，该漏洞源于可通过提示注入实现SQL注入，可能导致未经授权的数据操纵、数据泄露、通过删除所有数据而导致的拒绝服务(DoS)、多租户安全环境漏洞以及数据完整性问题。

AI Predicted 9.8 Difficulty: Easy EPSS 13.74% · P96
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-8309

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SQL Injection in langchain-ai/langchain
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
LangChain SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
LangChain是LangChain开源的一个用于开发由大型语言模型 （LLM） 提供支持的应用程序的框架。 LangChain 0.2.5版本存在SQL注入漏洞，该漏洞源于可通过提示注入实现SQL注入，可能导致未经授权的数据操纵、数据泄露、通过删除所有数据而导致的拒绝服务(DoS)、多租户安全环境漏洞以及数据完整性问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
langchain-ai langchain-ai/langchain unspecified ~ 0.3.0 -

II. Public POCs for CVE-2024-8309

# POC Description Source Link Shenlong Link
1 A PoC for CVE-2024–8309 https://github.com/liadlevy/CVE-2024-8309 POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-8309

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-8309 (1)

Vendor Advisories for CVE-2024-8309 (1)

Same Patch Batch · langchain-ai · 2024-10-29 · 3 CVEs total

CVE-2024-7774 Path Traversal in langchain-ai/langchainjs
CVE-2024-7042 Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection

IV. Related Vulnerabilities

Same product: langchain-ai/langchain
Same vendor: langchain-ai
Same weakness: CWE-89

V. Comments for CVE-2024-8309

No comments yet

Leave a comment