https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:55:53 +0000 https://cve.radiocsirt.org/vuln/cve-2024-7042 <p><strong>Affected:</strong> langchain-ai/langchainjs, langchain-ai langchainjs</p> <p>A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.</p> <p><strong>Affected:</strong> langchain-ai/langchainjs, langchain-ai langchainjs</p> <p>A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.</p> https://cve.radiocsirt.org/vuln/cve-2024-7042 https://cve.radiocsirt.org/vuln/ghsa-42h9-826w-cgv3 <p><strong>Affected:</strong> npm: axios</p> <p>## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.</p> <p>Applications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: Maximum call stack size exceeded`, causing request failure and, in applications that do not handle the exception or rejected promise, possible process termination.</p> <p>## Impact The impact is denial of service against applications that process untrusted `FormData` field names through axios&#39; FormData-to-JSON conversion.</p> <p>The vulnerable path is not reached by merely installing axios, by normal multipart `FormData` pass-through, or by ordinary axios requests that do not request JSON serialisation of `FormData`. In the default axios request, the error is produced before network I/O and returned as a rejected Promise. Direct use of `formToJSON()` throws synchronously.</p> <p>Server-side applications are the primary risk when remote users can submit arbitrary form field names, and the application converts those fields with `formToJSON()` or sends them through axios as JSON.</p> <p>## Affected Functionality Affected APIs and paths: - `axios.formToJSON(formData)` - `import { formToJSON } from &#34;axios&#34;` - `li…</p> <p><strong>Affected:</strong> npm: axios</p> <p>## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.</p> <p>Applications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: Maximum call stack size exceeded`, causing request failure and, in applications that do not handle the exception or rejected promise, possible process termination.</p> <p>## Impact The impact is denial of service against applications that process untrusted `FormData` field names through axios&#39; FormData-to-JSON conversion.</p> <p>The vulnerable path is not reached by merely installing axios, by normal multipart `FormData` pass-through, or by ordinary axios requests that do not request JSON serialisation of `FormData`. In the default axios request, the error is produced before network I/O and returned as a rejected Promise. Direct use of `formToJSON()` throws synchronously.</p> <p>Server-side applications are the primary risk when remote users can submit arbitrary form field names, and the application converts those fields with `formToJSON()` or sends them through axios as JSON.</p> <p>## Affected Functionality Affected APIs and paths: - `axios.formToJSON(formData)` - `import { formToJSON } from &#34;axios&#34;` - `li…</p> https://cve.radiocsirt.org/vuln/ghsa-42h9-826w-cgv3