Critical severity · published Mar 1, 2024
CVE-2024-2057
LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
langchain_community · LangChain
0.0.26 · source: vendor
LA
Langchain · Langchain
0.0.26 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2057
Broken Link
https://github.com/bayuncao/vul-cve-16
Broken Link
https://github.com/bayuncao/vul-cve-16/tree/main/PoC.pkl
Patch
https://github.com/langchain-ai/langchain/pull/18695
Permissions Required
https://vuldb.com/?ctiid.255372
Permissions Required
https://vuldb.com/?id.255372
More from langchain_community
7.4
CVE-2026-27795
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
4.1
CVE-2026-26019
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation