Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LangChain

CVE-2023-34540: Langchain OS Command Injection vulnerability

criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-x32c-59v5-h7fg

Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.

Published Jun 14, 2023 · Updated Sep 30, 2024

Affected packages

langchain

Ecosystem
PyPI
Affected
< 0.0.225
Fixed in
0.0.225
Check
pip show langchain

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LangChain vulnerabilities

All LangChain entries