{"data":{"id":"f1989fd4-9f60-457f-a553-c7f1ab65754b","title":"CVE-2024-7774: A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This…","summary":"CVE-2024-7774 is a path traversal flaw in the getFullPath method of langchain-ai/langchainjs version 0.2.5. The setFileContent, getParsedFile, and mdelete methods do not sanitize user input, letting attackers write files anywhere on the filesystem, overwrite existing text files, read .txt files, and delete files.","solution":"The source links a patch: commit a0fad77d6b569e5872bd4a9d33be0c0785e538a9 in the langchain-ai/langchainjs repository on GitHub. It does not state a fixed version or a configuration workaround.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-7774","publishedAt":"2024-10-29T17:15:09.930Z","cveId":"CVE-2024-7774","cweIds":["CWE-29","CWE-22"],"cvssScore":"9.1","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain@< 0.2.19 (fixed: 0.2.19)"],"affectedPackageNames":["langchain"],"affectedPackageRefs":["npm:langchain"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","langchainjs"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchainjs path traversal in getFullPath method","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00557,"epssCheckedAt":"2026-11-04T00:12:27.430Z","kevDateAdded":null,"advisoryAliases":["GHSA-hc5w-c9f8-9cc4"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:55.924Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-09-11T23:34:20.084Z","daysToFix":-48,"fixCheckedAt":"2026-10-29T21:45:18.019Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"langchain","fixedVersion":"0.2.19","matchedVersion":"0.2.19","fixReleasedAt":"2024-09-11T23:34:20.084Z","daysToFix":-48,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:17.868Z"}]}}