CVEvulnerability

CVE-2023-32786

7.5 HIGH Published 2023-10-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-10-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-74

Description

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Affected configurations

• langchain langchain (<= 0.0.155)

Related

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

Referenced by CWE · observed example (2)

  • CWE-1427 Improper Neutralization of Input Used for LLM Prompting weakness
  • CWE-918 Server-Side Request Forgery weakness

References