CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32786
https://notcve.org/view.php?id=CVE-2023-32786
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks. En Langchain hasta 0.0.155, la inyección rápida permite a un atacante forzar al servicio a recuperar datos de una URL arbitraria, esencialmente proporcionando SSRF y potencialmente inyectando contenido en tareas posteriores. • https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46229
https://notcve.org/view.php?id=CVE-2023-46229
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. LangChain anterior a 0.0.317 permite SSRF a través de document_loaders/recursive_url_loader.py porque el rastreo puede proceder desde un servidor externo a un servidor interno. • https://github.com/langchain-ai/langchain/commit/9ecb7240a480720ec9d739b3877a52f76098a2b8 https://github.com/langchain-ai/langchain/pull/11925 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 5CVE-2023-36281
https://notcve.org/view.php?id=CVE-2023-36281
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template. • https://github.com/tagomaru/CVE-2023-36281 https://github.com/miguelc49/CVE-2023-36281-2 https://github.com/miguelc49/CVE-2023-36281-1 https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55 https://github.com/hwchase17/langchain/issues/4394 https://github.com/langchain-ai/langchain/releases/tag/v0.0.312 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39659
https://notcve.org/view.php?id=CVE-2023-39659
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component. Un problema en langchain langchain-ai v.0.0.232 y anteriores permite a un atacante remoto ejecutar código arbitrario a través de un script manipulado en el componente PythonAstREPLTool._run. • https://github.com/langchain-ai/langchain/issues/7700 https://github.com/langchain-ai/langchain/pull/5640 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38896
https://notcve.org/view.php?id=CVE-2023-38896
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions. Un problema en langchain v.0.0.194 de Harrison Chase y anteriores permite a un atacante remoto ejecutar código arbitrario a través de las funciones from_math_prompt y from_colored_object_prompt. • https://github.com/hwchase17/langchain/issues/5872 https://github.com/hwchase17/langchain/pull/6003 https://twitter.com/llm_sec/status/1668711587287375876 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •