Critical severity · published Mar 1, 2024
CVE-2024-2057
A vulnerability was found in LangChain langchain_community 0.0.26
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
Langchain · Langchain
0.0.26 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2057
Broken Link
https://github.com/bayuncao/vul-cve-16
Broken Link
https://github.com/bayuncao/vul-cve-16/tree/main/PoC.pkl
Patch
https://github.com/langchain-ai/langchain/pull/18695
Permissions Required
https://vuldb.com/?ctiid.255372
Permissions Required
https://vuldb.com/?id.255372
More from Langchain
10.0
CVE-2025-2828
SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain
9.8
CVE-2024-8309
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection
9.8
CVE-2024-7042
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection
9.8
CVE-2023-39631
An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library
9.8
CVE-2023-36281
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt