Siewer

ConvertX is a self-hosted online file converter. The `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via the `unlink` function without sufficient validation. An attacker can supply path traversal sequences (e.g., `../`) in the `filename` parameter to delete arbitrary files outside the intended uploads directory, limited by the permissions of the server process. The vulnerable parameter is `filename`.

LangChain is a framework designed for building applications powered by Large Language Models (LLMs). A serialization issue exists in the `toJSON()` method of LangChain JS, impacting versions prior to 0.3.37 and 1.2.3 for LangChain, and prior to 0.3.80 and 1.1.8 for @langchain/core. This issue arises because the method does not properly escape objects containing 'lc' keys when serializing data using `JSON.stringify()`. The 'lc' key is used internally by LangChain to identify serialized objects. If user-supplied data includes this key structure, it may be incorrectly interpreted as a legitimate LangChain object during deserialization instead of being treated as plain user data. This could potentially lead to unauthorized access or manipulation of data.