CVE-2024-8309: Langchain SQL Injection Vulnerability
Summary
CVE-2024-8309: Langchain SQL Injection vulnerability. Affects langchain-community versions >= 0.2.0, < 0.2.19. Fixed in 0.2.19. How to fix ↓
Also tracked for
The same CVE-2024-8309 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Langchain is an open-source framework designed for building applications that utilize language models. It provides various tools and components to facilitate the integration of natural language processing capabilities into software solutions. However, version 0.2.5 of Langchain has been identified to contain a significant vulnerability that exposes it to SQL injection attacks, particularly through the GraphCypherQAChain class.
Vulnerability Detail
The vulnerability arises from improper handling of user inputs in the GraphCypherQAChain class, allowing attackers to perform SQL injection via prompt injection. This can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
How To Fix
Latest published version: 0.4.2 as of 23 Oct 2026
pip install --upgrade "langchain-community==0.4.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.19
This is the first release that contains the fix.
pip install --upgrade "langchain-community==0.2.19"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can sanitize and validate all user inputs before processing them in the GraphCypherQAChain class. This can help mitigate the risk of SQL injection until the package is updated. For example, you can implement input validation like this: 'if not is_valid_input(user_input): raise ValueError('Invalid input')'.
Conclusion
The Langchain SQL injection vulnerability (CVE-2024-8309) poses significant risks to applications using version 0.2.5 of the package. It is crucial to update to version 0.3.0 or later to mitigate these risks. Additionally, employing input validation can serve as a temporary measure to protect against potential attacks.
See every vulnerability recorded for langchain-community →
FAQ
SQL injection is a code injection technique that attackers use to exploit vulnerabilities in an application's software by inserting malicious SQL statements into an entry field for execution.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any installation.
The potential impacts include unauthorized data manipulation, data exfiltration, denial of service, and breaches in multi-tenant security environments, which can compromise the integrity of your database.
Yes, you can prevent SQL injection attacks by using prepared statements, parameterized queries, and input validation to ensure that user inputs are safe before processing.
If you cannot update the package immediately, implement input validation and sanitization as a temporary workaround to reduce the risk of exploitation until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain-community.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
