Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LangChain

CVE-2023-32785: Langchain SQL Injection vulnerability

criticalCVSS 3.1 9.8GHSA-8h5w-f6q9-wg35

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

Published Oct 21, 2023 · Updated Nov 7, 2024

Affected packages

langchain

Ecosystem
PyPI
Affected
< 0.0.247
Fixed in
0.0.247
Check
pip show langchain

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

Credited to bertuxdeveloper.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LangChain vulnerabilities

All LangChain entries