2 lines
4.7 KiB
JSON
2 lines
4.7 KiB
JSON
{"affected":[{"affectedData":[{"product":"langchain-ai/langchain","vendor":"langchain-ai","versions":[{"lessThan":"0.1.0","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@huntr.dev"},{"affectedData":[{"cpes":["cpe:2.3:a:langchain-ai:langchain-ai\\/langchain:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"langchain-ai\\/langchain","vendor":"langchain-ai","versions":[{"lessThan":"0.1.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*","matchCriteriaId":"E4C61594-8DC6-4202-BD26-E6DA580E438F","versionEndExcluding":"0.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"With the following crawler configuration:\n\n```python\nfrom bs4 import BeautifulSoup as Soup\n\nurl = \"https://example.com\"\nloader = RecursiveUrlLoader(\n url=url, max_depth=2, extractor=lambda x: Soup(x, \"html.parser\").text\n)\ndocs = loader.load()\n```\n\nAn attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like \"https://example.completely.different/my_file.html\" and the crawler would proceed to download that file as well even though `prevent_outside=True`.\n\nhttps://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51\n\nResolved in https://github.com/langchain-ai/langchain/pull/15559"},{"lang":"es","value":"Con la siguiente configuración del rastreador: ```python de bs4 import BeautifulSoup as Soup url = \"https://example.com\" loader = RecursiveUrlLoader( url=url, max_ Depth=2, extractor=lambda x: Soup(x, \"html .parser\").text ) docs = loader.load() ``` Un atacante que controle el contenido de `https://example.com` podría colocar un archivo HTML malicioso allí con enlaces como \"https:/example.completely.different/my_file.html\" y el rastreador procedería a descargar ese archivo también aunque `prevent_outside=True`. https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51 Resuelto en https://github.com/langchain-ai/langchain/pull /15559"}],"id":"CVE-2024-0243","lastModified":"2026-06-17T06:53:04.443","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":0.6,"impactScore":2.7,"source":"security@huntr.dev","type":"Secondary"}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-0243","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-02-26T18:43:11.371044Z","version":"2.0.3"}}]},"published":"2024-02-26T16:27:49.670","references":[{"source":"security@huntr.dev","tags":["Patch"],"url":"https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22"},{"source":"security@huntr.dev","tags":["Issue Tracking","Patch"],"url":"https://github.com/langchain-ai/langchain/pull/15559"},{"source":"security@huntr.dev","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"url":"https://github.com/langchain-ai/langchain/pull/15559"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861"}],"sourceIdentifier":"security@huntr.dev","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@huntr.dev","type":"Secondary"}]}
|