Vulnerability-Lookup

PYSEC-2026-1517

Vulnerability from pysec - Published: 2026-07-07 14:34 - Updated: 2026-07-07 17:24

Details

A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchain_core.prompts.ImagePromptTemplate's (and by extension langchain_core.prompts.ChatPromptTemplate's) with input variables that can read any user-specified path from the server file system. If the outputs of these prompt templates are exposed to the user, either directly or through downstream model outputs, it can lead to the exposure of sensitive information.

Severity

5.3 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impacted products

Name	purl
langchain-core	pkg:pypi/langchain-core

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langchain-core",
        "purl": "pkg:pypi/langchain-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.17"
            },
            {
              "fixed": "0.1.53"
            },
            {
              "introduced": "0.2.0"
            },
            {
              "fixed": "0.2.43"
            },
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.3.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.17",
        "0.1.18",
        "0.1.19",
        "0.1.20",
        "0.1.21",
        "0.1.22",
        "0.1.23",
        "0.1.24",
        "0.1.25",
        "0.1.26",
        "0.1.27",
        "0.1.28",
        "0.1.29",
        "0.1.30",
        "0.1.31",
        "0.1.32",
        "0.1.33",
        "0.1.33rc1",
        "0.1.34",
        "0.1.35",
        "0.1.36",
        "0.1.37",
        "0.1.38",
        "0.1.39",
        "0.1.40",
        "0.1.41",
        "0.1.42",
        "0.1.42rc1",
        "0.1.43",
        "0.1.44",
        "0.1.45",
        "0.1.46",
        "0.1.47",
        "0.1.47rc1",
        "0.1.48",
        "0.1.49",
        "0.1.50",
        "0.1.51",
        "0.1.52",
        "0.2.0",
        "0.2.1",
        "0.2.10",
        "0.2.11",
        "0.2.12",
        "0.2.13",
        "0.2.15",
        "0.2.16",
        "0.2.17",
        "0.2.18",
        "0.2.19",
        "0.2.2",
        "0.2.20",
        "0.2.21",
        "0.2.22",
        "0.2.23",
        "0.2.24",
        "0.2.25",
        "0.2.26",
        "0.2.27",
        "0.2.28",
        "0.2.29",
        "0.2.29rc1",
        "0.2.2rc1",
        "0.2.3",
        "0.2.30",
        "0.2.31",
        "0.2.32",
        "0.2.33",
        "0.2.34",
        "0.2.35",
        "0.2.36",
        "0.2.37",
        "0.2.38",
        "0.2.39",
        "0.2.4",
        "0.2.40",
        "0.2.41",
        "0.2.42",
        "0.2.5",
        "0.2.6",
        "0.2.7",
        "0.2.8",
        "0.2.9",
        "0.3.0",
        "0.3.1",
        "0.3.10",
        "0.3.11",
        "0.3.12",
        "0.3.13",
        "0.3.14",
        "0.3.2",
        "0.3.3",
        "0.3.4",
        "0.3.5",
        "0.3.6",
        "0.3.7",
        "0.3.8",
        "0.3.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-10940",
    "GHSA-5chr-fjjv-38qv"
  ],
  "details": "A vulnerability in langchain-core versions \u003e=0.1.17,\u003c0.1.53, \u003e=0.2.0,\u003c0.2.43, and \u003e=0.3.0,\u003c0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchain_core.prompts.ImagePromptTemplate\u0027s (and by extension langchain_core.prompts.ChatPromptTemplate\u0027s) with input variables that can read any user-specified path from the server file system. If the outputs of these prompt templates are exposed to the user, either directly or through downstream model outputs, it can lead to the exposure of sensitive information.",
  "id": "PYSEC-2026-1517",
  "modified": "2026-07-07T17:24:27.513564Z",
  "published": "2026-07-07T14:34:52.475462Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10940"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/commit/7d481f10102f43559cc57bcad7eba291067939ee"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/commit/e711034713259ae448981bc0fd1d7a5671499c31"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/langchain"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/langchain-core"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-5chr-fjjv-38qv"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "langchain-core allows unauthorized users to read arbitrary files from the host file system"
}

CVE-2024-10940 (GCVE-0-2024-10940)

Vulnerability from cvelistv5 – Published: 2025-03-20 10:08 – Updated: 2025-03-20 19:02

Title

Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Assigner

@huntr_ai

References

2 references

URL	Tags
https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57…
https://github.com/langchain-ai/langchain/commit/…

Impacted products

1 product

Vendor	Product	Version
langchain-ai	langchain-ai/langchain	Affected: unspecified , < 0.3.15 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10940",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T17:54:57.246319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T19:02:58.871Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langchain-ai/langchain",
          "vendor": "langchain-ai",
          "versions": [
            {
              "lessThan": "0.3.15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in langchain-core versions \u003e=0.1.17,\u003c0.1.53, \u003e=0.2.0,\u003c0.2.43, and \u003e=0.3.0,\u003c0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchain_core.prompts.ImagePromptTemplate\u0027s (and by extension langchain_core.prompts.ChatPromptTemplate\u0027s) with input variables that can read any user-specified path from the server file system. If the outputs of these prompt templates are exposed to the user, either directly or through downstream model outputs, it can lead to the exposure of sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-20T10:08:48.628Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27"
        },
        {
          "url": "https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68"
        }
      ],
      "source": {
        "advisory": "be1ee1cb-2147-4ff4-a57b-b6045271cf27",
        "discovery": "EXTERNAL"
      },
      "title": "Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-10940",
    "datePublished": "2025-03-20T10:08:48.628Z",
    "dateReserved": "2024-11-06T19:50:09.607Z",
    "dateUpdated": "2025-03-20T19:02:58.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-5CHR-FJJV-38QV

Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-05-20 18:18

Summary

langchain-core allows unauthorized users to read arbitrary files from the host file system

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langchain-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.17"
            },
            {
              "fixed": "0.1.53"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langchain-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.0"
            },
            {
              "fixed": "0.2.43"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langchain-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.3.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-10940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-497"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T16:43:25Z",
    "nvd_published_at": "2025-03-20T10:15:21Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in langchain-core versions \u003e=0.1.17,\u003c0.1.53, \u003e=0.2.0,\u003c0.2.43, and \u003e=0.3.0,\u003c0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchain_core.prompts.ImagePromptTemplate\u0027s (and by extension langchain_core.prompts.ChatPromptTemplate\u0027s) with input variables that can read any user-specified path from the server file system. If the outputs of these prompt templates are exposed to the user, either directly or through downstream model outputs, it can lead to the exposure of sensitive information.",
  "id": "GHSA-5chr-fjjv-38qv",
  "modified": "2025-05-20T18:18:37Z",
  "published": "2025-03-20T12:32:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10940"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/commit/7d481f10102f43559cc57bcad7eba291067939ee"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/commit/e711034713259ae448981bc0fd1d7a5671499c31"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/langchain"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "langchain-core allows unauthorized users to read arbitrary files from the host file system"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2026-1517

CVE-2024-10940 (GCVE-0-2024-10940)

GHSA-5CHR-FJJV-38QV

Tags

Sightings

Nomenclature