GitHub Advisoryadvisory · PyPI

GHSA-f2jm-rw3h-6phg LangChain pickle deserialization of untrusted data

HIGH Published 2024-09-17 Modified 2025-07-30 Official page ↗
Aliases
CVE-2024-5998
Ecosystem
PyPI
Packages
langchain-community
Severity
High
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-502
Reviewed
2024-09-17

Affected packages

• PyPI langchain-community: < 0.2.4 → fixed in 0.2.4

Description

A vulnerability in the `FAISS.deserialize_from_bytes` function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the `os.system` function. The issue affects versions prior to 0.2.4.

Related

Alias · CVE (1)

  • CVE-2024-5998 A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References