Langchain Server-Side Request Forgery vulnerability
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-32786US | high7.5 | — | ||
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting… | ||||
02
references
External citations — patches, advisories, analysis.
- https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1WEB
- https://github.com/advisories/GHSA-6h8p-4hx9-w66cADVISORY
- https://github.com/langchain-ai/langchainPACKAGE
- https://github.com/langchain-ai/langchain/pull/12747WEB
- https://github.com/langchain-ai/langchain/releases/tag/v0.0.329WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-32786ADVISORY
- https://pypi.org/project/langchainPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan