CVE-2024-8309

Advisory

Affected versions of langchain-ai/langchain are vulnerable to SQL injection through GraphCypherQAChain class. This vulnerability allows attackers to manipulate database queries via malicious input in prompts, potentially leading to unauthorized data access, manipulation, and cross-tenant data breaches. The vulnerability exists in the query processing logic of GraphCypherQAChain where user input is not properly sanitized. Successfully exploiting this requires access to the API endpoint.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-45pg-36p6-83v9
• https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8309