CVE-2024-10940

Executive Summary

CVE-2024-10940 is a path traversal vulnerability in the LangChain ecosystem, specifically within the langchain-core library. The flaw resides in the ImagePromptTemplate and ChatPromptTemplate classes, which allow user-controlled input variables to specify arbitrary file paths on the host server. When these prompt templates are rendered and their outputs are exposed (either directly or through a downstream model), an attacker can read sensitive files from the server’s filesystem. This vulnerability affects multiple version ranges of langchain-core and has a CVSS score of 5.3 (Medium). No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has released patched versions.

Supply Chain & Package Security

This vulnerability is in the PyPI package langchain-core. Organizations using LangChain in their AI/LLM pipelines must verify their dependency version and upgrade immediately. The attack vector is through crafted prompt templates, which could be injected via user input or through compromised upstream data sources. Supply chain risk is elevated because LangChain is widely used to orchestrate LLM interactions, and a compromised prompt template could leak API keys, database credentials, or other secrets stored on the server.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (limited to file read)
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the low complexity and network-based attack vector, but the impact is limited to file disclosure. However, in many environments, the ability to read arbitrary files (e.g., /etc/passwd, environment files, configuration files) can lead to privilege escalation or lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the ImagePromptTemplate class (and by extension ChatPromptTemplate) in langchain-core. These templates allow the inclusion of input variables that are substituted at runtime. The flaw is that the ImagePromptTemplate does not sanitize or restrict the file path provided in the input variable. When the template is rendered, it attempts to read the file from the specified path on the server’s filesystem.

Root Cause: The ImagePromptTemplate class uses a file loader that directly passes the user-supplied path to the filesystem without validation. This allows an attacker to use path traversal sequences (e.g., ../../../etc/passwd) to read arbitrary files.

Attack Scenario:

1. An attacker crafts a prompt template that includes an input variable pointing to a sensitive file.
2. The attacker submits this template to a LangChain service (e.g., a chatbot or API endpoint).
3. The server renders the template, reads the file, and includes its content in the prompt sent to the LLM.
4. The LLM’s response (or the template’s output) is returned to the attacker, revealing the file contents.

Affected Versions:

• >=0.1.17, <0.1.53
• >=0.2.0, <0.2.43
• >=0.3.0, <0.3.15

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

from langchain_core.prompts import ImagePromptTemplate

# Attacker-controlled input variable
template = ImagePromptTemplate(input_variables=["file_path"])
prompt = template.format(file_path="../../../etc/passwd")
# The prompt now contains the contents of /etc/passwd

Patched Code (>=0.1.53, >=0.2.43, >=0.3.15):

from langchain_core.prompts import ImagePromptTemplate
import os

# Patched version validates the file path
def safe_format(template, **kwargs):
    file_path = kwargs.get("file_path", "")
    # Ensure the path is within an allowed directory
    allowed_dir = "/safe/path"
    full_path = os.path.abspath(os.path.join(allowed_dir, file_path))
    if not full_path.startswith(allowed_dir):
        raise ValueError("Invalid file path")
    return template.format(file_path=full_path)

The patch introduces path validation to prevent directory traversal. The exact implementation may vary, but the core fix is to restrict file reads to a specific directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable LangChain service (e.g., a chatbot that accepts user prompts).
• The service must expose the output of the prompt template (either directly or through the LLM response).

Exploitation Steps:

1. Identify an endpoint that accepts prompt templates or user input that is passed to ImagePromptTemplate or ChatPromptTemplate.
2. Craft a payload that uses path traversal to read a sensitive file:

   Read the file at path: ../../../etc/passwd
   

3. Submit the payload. If the service returns the LLM’s response, the file contents may be included.
4. Extract sensitive data (e.g., usernames, SSH keys, configuration files).

Example Payload (for a chatbot):

User: What is in the file at ../../../etc/passwd?

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual file read operations from the LangChain process.
• Look for path traversal patterns in user input (e.g., ../, ..\\, absolute paths).
• Alert on any attempt to read files outside of the expected template directory.

Mitigation:

• Upgrade to a patched version of langchain-core.
• Implement input validation and sanitization for all user-supplied file paths.
• Use a whitelist of allowed file paths or directories.
• Run the LangChain service with minimal filesystem permissions (e.g., read-only access to a specific directory).
• Monitor logs for file read errors or unexpected file access.

Indicators of Compromise (IOCs)

• File Paths: Any attempt to read files outside of the expected template directory (e.g., /etc/passwd, /proc/self/environ, .env).
• Log Entries: Errors related to file not found or permission denied when reading files from unexpected paths.
• Network Traffic: Outbound connections from the LangChain service to an attacker-controlled server (if the attacker exfiltrates data).
• Process Behavior: The LangChain process reading files that are not part of its normal operation (e.g., reading /etc/shadow).

Detection Engineering

YARA Rule

rule CVE_2024_10940_LangChain_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in LangChain prompt templates"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-10940"
    strings:
        $path_traversal1 = "../" ascii wide
        $path_traversal2 = "..\\" ascii wide
        $path_traversal3 = "/etc/" ascii wide
        $path_traversal4 = "/proc/" ascii wide
        $path_traversal5 = "/sys/" ascii wide
        $path_traversal6 = "/var/" ascii wide
    condition:
        any of ($path_traversal*)
}

Sigma Rule

title: CVE-2024-10940 LangChain Path Traversal
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in LangChain prompt templates
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: langchain
detection:
    selection:
        - EventID: 4663  # File read
          ObjectName|contains:
              - '../'
              - '..\\'
              - '/etc/'
              - '/proc/'
              - '/sys/'
              - '/var/'
    condition: selection
falsepositives:
    - Legitimate use of file paths within allowed directories
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10940 LangChain Path Traversal Attempt"; flow:to_server,established; content:"../"; http_uri; nocase; content:"/etc/"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade langchain-core to the latest patched version:
   • For versions >=0.1.17, upgrade to >=0.1.53.
   • For versions >=0.2.0, upgrade to >=0.2.43.
   • For versions >=0.3.0, upgrade to >=0.3.15.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block path traversal patterns in user input.
3. Restrict the filesystem permissions of the LangChain service to only read from a specific directory.

Long-Term Measures:

• Conduct a security audit of all LangChain prompt templates to ensure no user-controlled file paths are used.
• Implement input validation and sanitization for all user-supplied data.
• Use a sandboxed environment (e.g., Docker with read-only filesystem) for running LangChain services.
• Monitor for any unusual file read activity.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact: threatintel@valters.it