CVE-2024-8309

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

• CWE-89
• CWE-74

• https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255Patch
• https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5Exploit, Third Party Advisory

Published

Oct 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8302A vulnerability was found in dingfanzu CMS up to 29d67d9044f…9.8
• CVE-2024-8303A vulnerability classified as critical has been found in din…6.3
• CVE-2024-8304A vulnerability has been found in jpress up to 5.1.1 and cla…4.9
• CVE-2024-8305prepareUnique index may cause secondaries to crash due to in…6.5
• CVE-2024-8306CWE-269: Improper Privilege Management vulnerability exists …7.8
• CVE-2024-8308A low privileged remote attacker can insert a SQL injection …6.5
• CVE-2024-8310OPW Fuel Management Systems SiteSentinel could allow an att…9.8
• CVE-2024-8311An issue was discovered with pipeline execution policies in …6.5
• CVE-2024-8312An issue has been discovered in GitLab CE/EE affecting all v…5.4
• CVE-2024-8313An Exposure of Sensitive System Information to an Unauthoriz…8.7
• CVE-2024-8314An Incorrect Implementation of Authentication Algorithm and …5.5
• CVE-2024-8315An Improper Handling of Insufficient Permissions or Privileg…6.8