GitHub Advisoryadvisory · PyPI

GHSA-8h5w-f6q9-wg35 Langchain SQL Injection vulnerability

CRITICAL Published 2023-10-21 Modified 2026-10-27 Official page ↗
Aliases
CVE-2023-32785
Ecosystem
PyPI
Packages
langchain
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-89
Reviewed
2023-10-24

Affected packages

• PyPI langchain: < 0.0.247 → fixed in 0.0.247

Description

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

Related

Alias · not in database (1)

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References