Lucene search

GitHub Advisory DatabaseGHSA-6H8P-4HX9-W66C

HistoryOct 21, 2023 - 12:30 a.m.

Langchain Server-Side Request Forgery vulnerability

2023-10-2100:30:47

CWE-74

CWE-918

GitHub Advisory Database

github.com

langchain

ssrf

vulnerability

software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

40.6%

JSON

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Affected configurations

Vulners

Node

langchainlangchainRange<0.0.329

VendorProductVersionCPE
langchainlangchain*cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
langchain	langchain	*	cpe:2.3:a:langchain:langchain::::::::

References

gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1

github.com/advisories/GHSA-6h8p-4hx9-w66c

github.com/langchain-ai/langchain/pull/12747

github.com/langchain-ai/langchain/releases/tag/v0.0.329

nvd.nist.gov/vuln/detail/CVE-2023-32786

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

40.6%

JSON

Related for GHSA-6H8P-4HX9-W66C