ImagePromptTemplate exposed sensitive system information via local file paths
ImagePromptTemplate in LangChain exposed a security vulnerability by accepting local file paths and converting them to data URLs, potentially allowing access to sensitive system information. The vulnerability was patched in version 0.3.15 by disabling local file path loading.
What happened
The ImagePromptTemplate component in LangChain accepted local file paths as input and converted them to data URLs using image_utils.image_to_data_url. This functionality allowed users to potentially load and expose sensitive files from the system.
Reported impact
Loading images from local file paths created a security exposure that could allow unauthorized access to sensitive system information.
Index analysis
The vulnerability was assigned CVE-2024-10940. The fix removed the ability to load images from local file paths, requiring users to specify images by URL instead.
Governance controls
In version 0.3.15 and later, the image loading functionality from local paths was disabled with a ValueError raised if a path parameter is provided.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.