GHSA-g28h-2cmm-rj9x: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

Summary

langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model requests. An attacker who controls image input passed to ChatNVIDIA or VLM reranking APIs can read files the application process can access and send them to the configured NVIDIA/NIM model endpoint.

Mitigation

Upgrade to langchain-nvidia-ai-endpoints >= 1.4.2, which rejects raw local filesystem paths for VLM image inputs. If upgrading is not immediately possible, reject local filesystem paths in user-controlled VLM image inputs, allow only trusted remote URLs, data URIs, or known safe asset/file IDs, and run the application with least-privilege filesystem access.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langchain-nvidia-ai-endpointsPyPILLM dependency since 2023-12-15 · 4 tracked dependents

Related items

• HighCVE-2026-65142: NVIDIA Model-Optimizer untrusted data deserializationSame vendor · NVD/CVE Database
• HighCVE-2026-47625: NVIDIA Triton Inference Server for Linux missing authorization flawSame vendor · NVD/CVE Database
• HighCVE-2026-16497: NVIDIA Triton Inference Server for Linux excessive iteration denial of serviceSame vendor · NVD/CVE Database
• MediumCVE-2026-47630: NVIDIA Triton Inference Server for Linux absolute path traversalSame vendor · NVD/CVE Database
• HighCVE-2026-47629: NVIDIA Triton Inference Server for Linux improper input validationSame vendor · NVD/CVE Database