CVE-2024-10940
2 advisories.
PyPI/langchain-core CVE-2024-10940: medium 5.3
langchain-core allows unauthorized users to read arbitrary files from the host file system
Action: Upgrade langchain-core to 0.1.53 or later.
pip install langchain-core==0.1.53pip install langchain-core==0.2.43pip install langchain-core==0.3.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.1.17 | 0.1.53 | - |
| 0.2.0 | 0.2.43 | - |
| 0.3.0 | 0.3.15 | - |
Fixed versions
| 0.1.53 | 0.2.43 | 0.3.15 |
Sources
- osv: GHSA-5chr-fjjv-38qv
- https://nvd.nist.gov/vuln/detail/CVE-2024-10940
- https://github.com/langchain-ai/langchain/commit/7d481f10102f43559cc57bcad7eba291067939ee
- https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68
- https://github.com/langchain-ai/langchain/commit/e711034713259ae448981bc0fd1d7a5671499c31
- https://github.com/langchain-ai/langchain
- https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27
CVE-2024-10940 · published · modified · JSON
PyPI/langchain-core CVE-2024-10940: medium 5.3
langchain-core allows unauthorized users to read arbitrary files from the host file system
Action: Upgrade langchain-core to 0.1.53 or later.
pip install langchain-core==0.1.53pip install langchain-core==0.2.43pip install langchain-core==0.3.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.1.17 | 0.1.53 | - |
| 0.2.0 | 0.2.43 | - |
| 0.3.0 | 0.3.15 | - |
Fixed versions
| 0.1.53 | 0.2.43 | 0.3.15 |
Sources
- osv: PYSEC-2026-1517
- https://nvd.nist.gov/vuln/detail/CVE-2024-10940
- https://github.com/langchain-ai/langchain/commit/7d481f10102f43559cc57bcad7eba291067939ee
- https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68
- https://github.com/langchain-ai/langchain/commit/e711034713259ae448981bc0fd1d7a5671499c31
- https://github.com/langchain-ai/langchain
- https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27
- https://pypi.org/project/langchain-core
- https://github.com/advisories/GHSA-5chr-fjjv-38qv
CVE-2024-10940 · published · modified · JSON