Lucene search

CVE-2024-21513

🗓️ 15 Jul 2024 05:01:15Reported by snykType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

Versions 0.0.15 to 0.0.21 of langchain-experimental package allow Arbitrary Code Execution from database inpu

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 11
Cvelist	CVE-2024-21513	15 Jul 202405:00	–	cvelist
NVD	CVE-2024-21513	15 Jul 202405:15	–	nvd
OSV	CVE-2024-21513	15 Jul 202405:15	–	osv
OSV	GHSA-CGCG-P68Q-3W7V langchain-experimental vulnerable to Arbitrary Code Execution	15 Jul 202406:30	–	osv
OSV	PYSEC-2024-62	15 Jul 202405:15	–	osv
Veracode	Code Injection	16 Jul 202405:59	–	veracode
RedhatCVE	CVE-2024-21513	5 Feb 202510:44	–	redhatcve
GithubExploit	Exploit for Code Injection in Langchain Langchain-Experimental	4 Mar 202513:11	–	githubexploit
GithubExploit	Exploit for Code Injection in Langchain Langchain-Experimental	9 Apr 202516:13	–	githubexploit
Vulnrichment	CVE-2024-21513	15 Jul 202405:00	–	vulnrichment

Nvd

Node

langchain langchain-experimentalRange0.0.15–0.0.21

[
  {
    "product": "langchain-experimental",
    "versions": [
      {
        "version": "0.0.15",
        "lessThan": "0.0.21",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
security	www.security.snyk.io/vuln/SNYK-PYTHON-LANGCHAINEXPERIMENTAL-7278171
github	www.github.com/langchain-ai/langchain/commit/7b13292e3544b2f5f2bfb8a27a062ea2b0c34561
github	www.github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py%23L81

Parameter	Position	Path	Description	CWE
SQL query	request body	/path/to/sql/query/endpoint	Arbitrary code execution vulnerability via SQL input that allows attackers to run arbitrary code using eval().	CWE-94

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

15 Jul 2024 05:15Current

8.2High risk

Vulners AI Score8.2

CVSS38.5

EPSS0.0277

SSVC

CWE-94