GitHub Advisoryadvisory · PyPI

GHSA-6h8p-4hx9-w66c Langchain Server-Side Request Forgery vulnerability

HIGH Published 2023-10-21 Modified 2023-11-02 Official page ↗
Aliases
CVE-2023-32786
Ecosystem
PyPI
Packages
langchain
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-74, CWE-918
Reviewed
2023-10-24

Affected packages

• PyPI langchain: < 0.0.329 → fixed in 0.0.329

Description

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Related

Alias · CVE (1)

  • CVE-2023-32786 In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially… vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-918 Server-Side Request Forgery weakness

References