CVE-2024-7042: SQL Injection Vulnerability in @langchain/community Package
Summary
CVE-2024-7042: @langchain/community SQL Injection vulnerability. Affects @langchain/community versions < 0.3.3. Fixed in 0.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @langchain/community package is part of the LangChain framework, which is designed for building applications that utilize language models. This package provides various tools and utilities for developers to create and manage language-based applications. However, it has been identified to contain a significant SQL injection vulnerability in the GraphCypherQAChain class, which can lead to unauthorized data manipulation and security breaches.
Vulnerability Detail
The vulnerability arises from improper handling of user inputs within the GraphCypherQAChain class in langchain-ai/langchainjs versions 0.2.5 and earlier. This flaw allows attackers to perform prompt injection, which can lead to SQL injection attacks. The consequences of this vulnerability include unauthorized access to sensitive data, the ability to create, update, or delete database nodes and relationships without authorization, and potential denial of service (DoS) attacks by deleting critical data. Additionally, it poses risks in multi-tenant environments, where attackers could access data across different tenants, compromising data integrity and security.
How To Fix
Minimum fixed version
0.3.3
This is the first release that contains the fix.
npm install @langchain/community@0.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization to mitigate the risk of SQL injection. Ensure that any user inputs are properly escaped and validated before being processed by the application. However, this is not a substitute for updating to the patched version.
Conclusion
The SQL injection vulnerability identified as CVE-2024-7042 in the @langchain/community package poses significant risks to applications utilizing this package. It is crucial for developers to update to the patched version 0.3.3 or later to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for @langchain/community →
FAQ
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
The affected versions are 0.2.5 and all earlier versions that include the GraphCypherQAChain class.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup or installation.
The potential impacts include unauthorized data manipulation, data exfiltration, denial of service attacks, and breaches in multi-tenant security environments.
Related vulnerabilities
Recent vulnerabilities recorded for @langchain/community.
