Old CVE-2024-7774 is reported by AWS scanner - is it valid?

[nooneimportant-x]

Checked other resources

• I added a very descriptive title to this question.
• I searched the LangChain documentation with the integrated search.
• I used the GitHub search to find a similar question and didn't find it.

Commit to Help

• I commit to help with one of those options 👆

Example Code

n/a

Description

Hi!

AWS recently started to reporting langchain package as Critical Vulnerability without a fix, pointing to this old CVE-2024-7774.

I've checked that it was fixed here https://github.com/langchain-ai/langchainjs/releases/tag/0.2.19, but this is JS flavor.

So now I'm wondering if this is valid, as that scanner was quiet about it for all that time.

System Info

n/a

[madudevi-flutterint]

Hi, I've also noticed this recently. can someone help me with this.

[nooneimportant-x]

I believe it was some AWS false-positive, as now status changed to closed on their side.