CyberRota Analysis
AI-GeneratedThe @langchain/redis component of the LangChain framework is vulnerable due to improper escaping of attacker-controlled values in RediSearch TAG and TEXT filters, potentially allowing unauthorized access to indexed documents. This could lead to the exposure of sensitive information if an application uses these filters as access boundaries. Organizations utilizing LangChain versions prior to 1.1.1 should prioritize upgrading to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search query. When an application uses an attacker-influenceable filter as a tenant or document-access boundary, the modified query can expose indexed documents outside the attacker's intended scope. This issue is fixed in version 1.1.1.