CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32786
https://notcve.org/view.php?id=CVE-2023-32786
20 Oct 2023 — In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks. En Langchain hasta 0.0.155, la inyección rápida permite a un atacante forzar al servicio a recuperar datos de una URL arbitraria, esencialmente proporcionando SSRF y potencialmente inyectando contenido en tareas posteriores. • https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46229
https://notcve.org/view.php?id=CVE-2023-46229
19 Oct 2023 — LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. LangChain anterior a 0.0.317 permite SSRF a través de document_loaders/recursive_url_loader.py porque el rastreo puede proceder desde un servidor externo a un servidor interno. • https://github.com/langchain-ai/langchain/commit/9ecb7240a480720ec9d739b3877a52f76098a2b8 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2023-39631
https://notcve.org/view.php?id=CVE-2023-39631
01 Sep 2023 — An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library. Un problema en LanChain-ai Langchain v.0.0.245 permite a un atacante remoto ejecutar código arbitrario a través de la función evaluate en numexpr library. • https://github.com/langchain-ai/langchain/issues/8363 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 5CVE-2023-36281
https://notcve.org/view.php?id=CVE-2023-36281
22 Aug 2023 — An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template. • https://github.com/tagomaru/CVE-2023-36281 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2023-38860
https://notcve.org/view.php?id=CVE-2023-38860
15 Aug 2023 — An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. Un problema en LangChain v.0.0.231 permite a un atacante remoto ejecutar código arbitrario a través del parámetro prompt. • https://github.com/hwchase17/langchain/issues/7641 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39659
https://notcve.org/view.php?id=CVE-2023-39659
15 Aug 2023 — An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component. Un problema en langchain langchain-ai v.0.0.232 y anteriores permite a un atacante remoto ejecutar código arbitrario a través de un script manipulado en el componente PythonAstREPLTool._run. • https://github.com/langchain-ai/langchain/issues/7700 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38896
https://notcve.org/view.php?id=CVE-2023-38896
15 Aug 2023 — An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions. Un problema en langchain v.0.0.194 de Harrison Chase y anteriores permite a un atacante remoto ejecutar código arbitrario a través de las funciones from_math_prompt y from_colored_object_prompt. • https://github.com/hwchase17/langchain/issues/5872 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-36095
https://notcve.org/view.php?id=CVE-2023-36095
05 Aug 2023 — An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt. • http://langchain.com • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-36189
https://notcve.org/view.php?id=CVE-2023-36189
06 Jul 2023 — SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component. • https://gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533f • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-36188
https://notcve.org/view.php?id=CVE-2023-36188
06 Jul 2023 — An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method. • https://github.com/hwchase17/langchain/issues/5872 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •