Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-497.
Summary
A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchain_core.prompts.ImagePromptTemplate's (and by extension langchain_core.prompts.ChatPromptTemplate's) with input variables that can read any user-specified path from the server file system. If the outputs of these prompt templates are exposed to the user, either directly or through downstream model outputs, it can lead to the exposure of sensitive information.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| langchain-ai | langchain-ai/langchain | before 0.3.15 | 0.3.15 | Patch available | CNA |
| — | langchain-core (PyPI) | 0.1.17 to before 0.1.53 | 0.1.53 | Patch available | GHSA-5chr-fjjv-38qv |
| — | langchain-core (PyPI) | 0.2.0 to before 0.2.43 | 0.2.43 | Patch available | GHSA-5chr-fjjv-38qv |
| — | langchain-core (PyPI) | 0.3.0 to before 0.3.15 | 0.3.15 | Patch available | GHSA-5chr-fjjv-38qv |
- langchain-ai/langchain Vendorlangchain-ai Affected before 0.3.15 Fixed in 0.3.15 Patch available CNA
- langchain-core (PyPI) Vendor— Affected 0.1.17 to before 0.1.53 Fixed in 0.1.53 Patch available GHSA-5chr-fjjv-38qv
- langchain-core (PyPI) Vendor— Affected 0.2.0 to before 0.2.43 Fixed in 0.2.43 Patch available GHSA-5chr-fjjv-38qv
- langchain-core (PyPI) Vendor— Affected 0.3.0 to before 0.3.15 Fixed in 0.3.15 Patch available GHSA-5chr-fjjv-38qv
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:* | — | — | langchain-ai |
- cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:* Versions — — ·langchain-ai
Remediation
- Fix · CNA langchain-ai/langchain (langchain-ai) Fixed in 0.3.15
- Fix · GHSA-5chr-fjjv-38qv langchain-core (PyPI) Fixed in 0.1.53 Advisory →
- Fix · GHSA-5chr-fjjv-38qv langchain-core (PyPI) Fixed in 0.2.43 Advisory →
- Fix · GHSA-5chr-fjjv-38qv langchain-core (PyPI) Fixed in 0.3.15 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- OpenShift Lightspeed
- Red Hat Enterprise Linux AI (RHEL AI)
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10940
- 2026-10-03 Alias added: GHSA-5chr-fjjv-38qv
References
Other 5
- https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27
- https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68
- https://github.com/langchain-ai/langchain/commit/7d481f10102f43559cc57bcad7eba291067939ee
- https://github.com/langchain-ai/langchain/commit/e711034713259ae448981bc0fd1d7a5671499c31
- https://github.com/langchain-ai/langchain
More langchain-ai vulnerabilities
- TI-2024-31340 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain… CVSS 3.1CRITICAL 9.8
- TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
- TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
- TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-10940 · CVE Program
- CVE-2024-10940 · NVD
- FIRST EPSS
- GHSA-5chr-fjjv-38qv · GitHub Advisory Database · CC BY 4.0
- CVE-2024-10940 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences