CVEvulnerability

CVE-2024-5998

7.8 HIGH Published 2024-09-17 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-09-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
5.2 MEDIUM — CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-502

Description

A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

Affected configurations

• langchain langchain (< 0.2.9)

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References