CVE-2024-10940

Summary

CVE-2024-10940 is a vulnerability affecting langchain-core versions greater than 0.1.17 but less than 0.1.53, as well as versions greater than 0.2.0 but less than 0.2.43, and greater than 0.3.0 but less than 0.3.15. This issue allows unauthorized users to read arbitrary files from the host file system. The vulnerability lies in the langchain_core.prompts.ImagePromptTemplate (and consequently langchain_core.prompts.ChatPromptTemplate) where users can create these templates with user-specified paths. If outputs from these prompt templates are exposed to users, either directly or through downstream model outputs, sensitive information can be exposed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.