Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:langchain:langchain-Nvidia-Ai-Endpoints:*:*:*:*:*:*:*:*

1 brief RSS
high advisory

Local File Disclosure in langchain-nvidia-ai-endpoints

The langchain-nvidia-ai-endpoints library versions prior to 1.4.2 are vulnerable to local file disclosure when attacker-controlled image inputs are passed to ChatNVIDIA or VLM reranking APIs, leading to unauthorized file reading and exfiltration to remote endpoints.

langchain-nvidia-ai-endpoints vulnerability local-file-inclusion python supply-chain
1t 1c