VulnSocial

CVE-2024-8309General(langchain / langchain)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

langchain CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-89CWE-74

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • langchain

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-02-17); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
langchain
Products
langchain

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-02-17: 2Mentions · 2026-06-15: 1Technical Details · 2026-06-15: 102-1706-15
Signal classification1 categories
General
3100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-02-172
General2
2026-06-151
General1
Full discourse3 posts
  • Nathan House@GotoNathan
    General

    Prompt injection → AI generates SQL → developer passes it straight to DB → attacker owns the database. That is insecure output handling. LangChain CVE-2024-8309. http://Vanna.AI CVE-2024-5565. Cisco 2025 white-on-white Confluence RAG. AI output is user input. Treat it that way. 🧠 https://app.stationx.net/tools/types-of-ai #AISecurity

    Post summary

    The post outlines a prompt injection that leads to SQL injection via insecure output handling, mentioning CVE-2024-8309 (LangChain) and CVE-2024-5565 (Vanna.AI) but provides no evidence of exploitation, PoC, or mitigation.

    00010199
    23.1K followersView on X
  • めしうま@meshiumavip
    General

    NGリストの公開は問題ないけど、使ってるライブラリが2年前から更新されてなくて、少し確認しただけで2件critical CVE出てるのでそっちのがやばい🥹 https://nvd.nist.gov/vuln/detail/CVE-2024-8309 https://nvd.nist.gov/vuln/detail/CVE-2025-24158

    Post summary

    The post notes that two critical CVEs have been identified in unused-updated libraries, implying a potential security concern but providing no further details.

    000101.0K
    217 followersView on X
  • めしうま@meshiumavip
    General

    @lamrongol と思ったけどバージョン低すぎるからセキュリティダメですね、2年前から2件criticalのCVE出てる 稼働してるなら今すぐメンテしたほうがいいし、酷いわ ・https://nvd.nist.gov/vuln/detail/CVE-2024-8309 ・https://nvd.nist.gov/vuln/detail/CVE-2025-24158

    Post summary

    The post notes that the software version is too low and points to two critical CVEs, urging immediate maintenance.

    00010282
    217 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applangchainlangchain0.2.5--

Explore more

Back to dashboardlangchain CVEslangchain vulnerabilities