MediumVulnerability
CVE-2024-2057: A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-2057
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
A critical vulnerability in LangChain langchain_community 0.0.26 affects the load_local function in libs/community/langchain_community/retrievers/tfidf.py, part of the TFIDFRetriever component. Manipulation of this function leads to server-side request forgery, and the attack can be launched remotely. The exploit is public and may be used.
Mitigation
Upgrade to version 0.0.27, which is able to address this issue. It is recommended to upgrade the affected component.
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database