{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-22T21:06:16.871","vulnerabilities":[{"cve":{"id":"CVE-2024-8309","sourceIdentifier":"security@huntr.dev","published":"2024-10-29T13:15:10.950","lastModified":"2024-11-01T19:19:20.327","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database."},{"lang":"es","value":"Una vulnerabilidad en la clase GraphCypherQAChain de la versión 0.2.5 de langchain-ai/langchain permite la inyección de SQL a través de la inyección de mensajes. Esta vulnerabilidad puede provocar manipulación de datos no autorizada, exfiltración de datos, denegación de servicio (DoS) mediante la eliminación de todos los datos, infracciones en entornos de seguridad de múltiples tenants y problemas de integridad de los datos. Los atacantes pueden crear, actualizar o eliminar nodos y relaciones sin la debida autorización, extraer datos confidenciales, interrumpir servicios, acceder a datos de diferentes tenants y comprometer la integridad de la base de datos."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.4,"impactScore":3.4}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langchain:langchain:0.2.5:*:*:*:*:*:*:*","matchCriteriaId":"7B64914C-D055-40ED-91D4-BC39AB147771"}]}]}],"references":[{"url":"https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255","source":"security@huntr.dev","tags":["Patch"]},{"url":"https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5","source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"]}]}}]}