CVE-2024-8309: langchain

csirt@kutim:~/threat-intel/cve/CVE-2024-8309

CVSS 9.8 · Critical EPSS 13,7%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada langchain. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

Rincian

Terbit di NVD: 29 Oktober 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari): 13,7% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
langchain	langchain	Versi 0.2.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255 patch
https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.