High severity7.5NVD Advisory· Published Oct 20, 2023· Updated Jun 17, 2026
CVE-2023-32786
CVE-2023-32786
Description
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
langchainPyPI | < 0.0.329 | 0.0.329 |
Affected products
3cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*range: <=0.0.155
- (no CPE)
Patches
Vulnerability mechanics
References
5- gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-6h8p-4hx9-w66cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-32786ghsaADVISORY
- github.com/langchain-ai/langchain/pull/12747ghsaWEB
- github.com/langchain-ai/langchain/releases/tag/v0.0.329ghsaWEB
News mentions
0No linked articles in our index yet.