GitHub Advisoryadvisory · PyPI

GHSA-x32c-59v5-h7fg Langchain OS Command Injection vulnerability

CRITICAL Published 2023-06-14 Modified 2024-09-30 Official page ↗
Aliases
CVE-2023-34540
Ecosystem
PyPI
Packages
langchain
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2023-06-14

Affected packages

• PyPI langchain: < 0.0.225 → fixed in 0.0.225

Description

Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.

Related

Alias · CVE (1)

  • CVE-2023-34540 Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References