LangChainJS getFullPath path traversal
Date: 2024-08
Affected: langchainjs 0.2.5
Attack vector: path-traversal
Category: real-world
Severity: Critical
CVE: CVE-2024-7042
CVE-2024-7774
CVE-2025-68665
CVE-2026-26019
CVE-2026-27795
CWE: CWE-22
CWE-29
CWE-502
CWE-89
CWE-918
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

A path traversal vulnerability in the getFullPath method of langchain-ai/langchainjs 0.2.5. Attackers can save files anywhere in the filesystem, overwrite text files, read .txt files and delete files via the setFileContent, getParsedFile, and mdelete methods.


Mitigations:

Architectural layers (MAESTRO):