Sensitive file disclosure via ImagePromptTemplate in LangChain (CVE-2024-10940)
Date: 2024
Affected: langchain-ai/langchain-core
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High

langchain-core 0.1.17-0.1.53, 0.2.0-0.2.43, 0.3.0-0.3.15 allows unauthorized users to read arbitrary files from the host file system via ImagePromptTemplate.


Mitigations:

Architectural layers (MAESTRO):