Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LangChain

CVE-2023-32786: Langchain Server-Side Request Forgery vulnerability

highCVSS 3.1 7.5GHSA-6h8p-4hx9-w66c

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Published Oct 21, 2023 · Updated Nov 11, 2023

Affected packages

langchain

Ecosystem
PyPI
Affected
< 0.0.329
Fixed in
0.0.329
Check
pip show langchain

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Credited to eyurtsev.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LangChain vulnerabilities

All LangChain entries