high7.5
CVE-2023-32786
Langchain Server-Side Request Forgery vulnerability
Impact
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | langchain | < 0.0.329 | 0.0.329 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Langchain | Langchain | through 0.0.155 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1
- https://github.com/advisories/GHSA-6h8p-4hx9-w66c
- https://nvd.nist.gov/vuln/detail/CVE-2023-32786
- https://github.com/langchain-ai/langchain/pull/12747
- https://github.com/langchain-ai/langchain/releases/tag/v0.0.329