AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-g28h-2cmm-rj9x: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

highvulnerability

security

Source: GitHub Advisory DatabaseSeptember 24, 2026

Summary

The `langchain-nvidia-ai-endpoints` library (a tool for connecting language models to NVIDIA's AI services) before version 1.4.2 had a local file disclosure vulnerability where attackers could trick the software into reading files from the computer's filesystem by providing malicious image inputs to Vision Language Model (VLM, an AI that processes images and text) requests. If an application let untrusted users control which images to process, attackers could access any files the application could read.

Solution / Mitigation

Upgrade to `langchain-nvidia-ai-endpoints >= 1.4.2`. The patched version rejects raw local filesystem paths for VLM image inputs and only accepts remote URLs, `data:image/...;base64,...` URIs (inline image data), and supported asset/file IDs. If immediate upgrade is not possible, reject local filesystem paths in user-controlled VLM image inputs and only allow trusted remote URLs, data URIs, or known safe asset/file IDs. Additionally, run applications with least-privilege filesystem access so the application process cannot read files it does not need.