CVE-2024-28088 Overview
CVE-2024-28088 is a path traversal vulnerability affecting LangChain through version 0.1.10. The flaw resides in the load_chain function, which accepts a path parameter intended to fetch configurations from the hwchase17/langchain-hub GitHub repository. An attacker able to control the final segment of that path parameter can inject ../ directory traversal sequences. This bypasses the intended repository restriction and allows loading of arbitrary chain configurations. Successful exploitation can lead to disclosure of API keys for large language model services or remote code execution. A patch is available in langchain-core release 0.1.29.
Critical Impact
Attackers can leak LLM API keys or achieve remote code execution by controlling the tail of the path passed to load_chain.
Affected Products
- LangChain versions up to and including 0.1.10
- langchain-core prior to 0.1.29
- Applications embedding load_chain with user-influenced path parameters
Discovery Timeline
- 2024-03-04 - CVE-2024-28088 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-28088
Vulnerability Analysis
LangChain provides the load_chain utility in libs/core/langchain_core/utils/loading.py to load prebuilt chain configurations. The function is designed to fetch YAML or JSON configurations exclusively from the hwchase17/langchain-hub GitHub repository. When a path string like lc://chains/foo/chain.json is supplied, the loader concatenates that path to a base URL pointing at the trusted repository.
The vulnerability arises because the path segment is not sanitized against directory traversal sequences. An actor who controls the tail of the path can inject ../ sequences that escape the intended repository namespace. The resolved URL then points at an attacker-controlled resource rather than the sanctioned hub. LangChain proceeds to load and instantiate the remote configuration as if it were trusted.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22] combined with incomplete filtering of ../ sequences [CWE-31]. The loader trusts that any string prefixed with the hub identifier resolves within the hub namespace. It performs no canonicalization or allowlist validation on the final path component before issuing the network fetch.
Attack Vector
Exploitation requires an application that passes attacker-influenced input into load_chain. The attacker supplies a crafted path containing ../ traversal sequences that redirect the fetch to a malicious host or an untrusted repository path. The returned configuration can reference remote code, prompt injection payloads, or credentials-exfiltration logic. When LangChain instantiates the loaded chain, unsafe deserialization primitives can execute attacker-controlled Python, resulting in remote code execution or leakage of environment secrets such as OpenAI API keys.
A public proof-of-concept demonstrating remote code execution is documented in the PinkDraconian PoC repository. The vulnerable code path is visible in the LangChain loading module.
Detection Methods for CVE-2024-28088
Indicators of Compromise
- Outbound HTTPS requests from application hosts to GitHub raw content URLs containing ..%2F or ../ in the path.
- Unexpected DNS resolutions to hosts other than raw.githubusercontent.com originating from Python processes running LangChain.
- Python child processes spawned by application workers shortly after invoking load_chain.
- Egress of environment variables containing OPENAI_API_KEY, ANTHROPIC_API_KEY, or similar secrets to unexpected destinations.
Detection Strategies
- Inspect application logs for load_chain calls whose path parameter contains .., URL-encoded traversal sequences, or absolute URLs.
- Perform dependency scanning across Python environments to flag langchain and langchain-core versions prior to 0.1.29.
- Enable network egress monitoring on hosts running LangChain workloads and alert on non-allowlisted destinations.
Monitoring Recommendations
- Alert on process trees where Python interpreters spawn shells, curl, or wget immediately after LangChain module imports.
- Monitor for file writes to /tmp or user home directories originating from LangChain worker processes.
- Correlate authentication anomalies on LLM provider dashboards with LangChain application activity to identify API key misuse.
How to Mitigate CVE-2024-28088
Immediate Actions Required
- Upgrade langchain-core to release 0.1.29 or later, which contains the fix delivered in pull request #18600.
- Audit application code for any invocation of load_chain and confirm the path argument is not derived from user input.
- Rotate any LLM provider API keys that may have been exposed on hosts running vulnerable LangChain versions.
Patch Information
The vendor merged the fix in langchain-ai/langchain pull request #18600 and shipped it in langchain-core 0.1.29. The patch validates the resolved path against the intended repository namespace and rejects traversal sequences before issuing the network request.
Workarounds
- Refuse to pass user-controlled strings into load_chain; use a server-side allowlist of chain identifiers instead.
- Restrict outbound network access from LangChain workloads to raw.githubusercontent.com and required LLM provider endpoints only.
- Store LLM API keys in a secrets manager and inject them at runtime with least-privilege scopes to limit blast radius if disclosure occurs.
# Upgrade LangChain core to a patched release
pip install --upgrade 'langchain-core>=0.1.29'
# Verify the installed version
python -c "import langchain_core; print(langchain_core.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
