CVE-2024-7042

An attacker without any permissions and without user interaction can inject malicious data into the prompt handled by the GraphCypherQAChain class, resulting in execution of unintended database queries (SQL injection). Lack of proper input validation and sanitization allows manipulation of queries directed to the graph database. As a result, it is possible to create, modify, and delete nodes and relationships without authorization.

An attacker can perform unauthorized data manipulation, exfiltrate sensitive information, destroy all data in the database (DoS), gain access to data of other tenants in multi-tenant environments, and compromise the integrity of the entire database.

Patches available from the vendor should be applied according to references — available fix commit: https://github.com/langchain-ai/langchainjs/commit/615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6. It is recommended to update the library to a version containing the fix as soon as possible.

langchain-ai/langchainjs version 0.2.5 and all versions containing the GraphCypherQAChain class