CVE-2023-32785
criticalrejectedpriority · track · 0USRejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-36189. Reason: This record is a duplicate of CVE-2023-36189. Notes: All CVE users should reference CVE-2023-36189 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-8h5w-f6q9-wg35Langchain SQL Injection vulnerability2023-10-21ghsa · osvUS
In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.
- PYSEC-2026-372Langchain SQL Injection vulnerability2026-06-29vendor · osvUS
In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-32785/cnnvd
- https://gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533fcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-32785cnnvd
- https://gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533fenisa_euvd
- https://github.com/langchain-ai/langchainenisa_euvd
- https://github.com/langchain-ai/langchain/issues/5923#issuecomment-1696053841enisa_euvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-32785enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan