{"data":{"id":"71639523-7827-42bf-90bd-edfcc5881aca","title":"CVE-2024-7042: A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this…","summary":"CVE-2024-7042 affects the GraphCypherQAChain class in langchain-ai/langchainjs, in version 0.2.5 and all versions containing this class. Prompt injection in the class leads to SQL injection, allowing an attacker to create, update, or delete nodes and relationships without authorization, extract sensitive data, and cause denial of service by deleting all data. The flaw also enables access across tenants in multi-tenant environments and damages database integrity.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-7042","publishedAt":"2024-10-29T17:15:08.883Z","cveId":"CVE-2024-7042","cweIds":["CWE-89"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["@langchain/community@< 0.3.3 (fixed: 0.3.3)"],"affectedPackageNames":["@langchain/community"],"affectedPackageRefs":["npm:@langchain/community"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","langchainjs","GraphCypherQAChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchainjs GraphCypherQAChain prompt injection leading to SQL injection","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00311,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-6m59-8fmv-m5f9"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:56.439Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-09-25T06:27:19.285Z","daysToFix":-34,"fixCheckedAt":"2026-10-29T21:45:18.778Z","capecIds":["CAPEC-66"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"@langchain/community","fixedVersion":"0.3.3","matchedVersion":"0.3.3","fixReleasedAt":"2024-09-25T06:27:19.285Z","daysToFix":-34,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:18.628Z"}]}}