Langchain Server-Side Request Forgery vulnerability
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-32786US | high7.5 | — | ||
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1WEB
- https://github.com/advisories/GHSA-6h8p-4hx9-w66cADVISORY
- https://github.com/langchain-ai/langchainPACKAGE
- https://github.com/langchain-ai/langchain/pull/12747WEB
- https://github.com/langchain-ai/langchain/releases/tag/v0.0.329WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-32786ADVISORY
- https://pypi.org/project/langchainPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan