High severityNVD Advisory· Published Oct 20, 2023· Updated Sep 12, 2024

CVE-2023-32786

Description

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
langchainPyPI	< 0.0.329	0.0.329

Affected products

Langchain AI/Langchaincpe-rescue
ghsa-coords
pkg:pypi/langchain
Range: < 0.0.329

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-6h8p-4hx9-w66cghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-32786ghsaADVISORY
gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1ghsaWEB
github.com/langchain-ai/langchain/pull/12747ghsaWEB
github.com/langchain-ai/langchain/releases/tag/v0.0.329ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000