PYSEC-2024-53

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

apsbot (>=0.2.0, <=0.3.1), askagent (>=0.1.0, <=0.1.1) +36 more potentially affected by CVE-2024-38459 via langchain-experimental (>=0.0.8, <=0.0.60)

langchain-experimental PYPI version =0.0.8, =0.2.0, =0.1.0, =0.0.3, =0.1.1, =0.0.1a1, =0.1.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.21, =0.1.27 and more Source cves: CVE-2024-38459 Source advisory: OSV:PYSEC-2024-53...

ceylon (>=0.2.0b1, <=0.20.0), gpt-all-star (>=0.0.52, <=0.0.54) +2 more potentially affected by CVE-2024-38459 via langchain-experimental (0.0.64)

langchain-experimental PYPI version 0.0.64 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-experimental and may be impacted: - ceylon =0.2.0b1, =0.0.52, =0.1.5, =2.4.48, =2.5.19 Source cves: CVE-2024-38459 Source advisory: OSV:PYSEC-2024-53...

archive-retriever (0.1.0), crewai (>=0.61.0, <=0.70.1) +17 more potentially affected by CVE-2024-38459 via langchain-experimental (0.0.65)

langchain-experimental PYPI version 0.0.65 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-experimental and may be impacted: - archive-retriever 0.1.0 - crewai =0.61.0, =0.1.3, =0.1.114, =0.1.120a1, =0.1.120, =0.7.1, =0.0.48, =0.0.96.dev6,...

PYSEC-2024-53

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

CVE-2024-38459

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

CVE-2024-38459

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

apsbot (>=0.2.0, <=0.3.1), askagent (>=0.1.0, <=0.1.1) +36 more potentially affected by CVE-2024-38459 via langchain-experimental (>=0.0.8, <=0.0.60)

langchain-experimental PYPI version =0.0.8, =0.2.0, =0.1.0, =0.0.3, =0.1.1, =0.0.1a1, =0.1.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.21, =0.1.27 and more Source cves: CVE-2024-38459 Source advisory: MEND:CVE-2024-38459...

CVE-2024-38459

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

PT-2024-28015

Name of the Vulnerable Software and Affected Versions LangChain Experimental versions prior to 0.0.61 Description The issue arises from an incomplete fix, allowing Python REPL access without an opt-in step. Recommendations For versions prior to 0.0.61, update to version 0.0.61 or later to resolve...

LangChain Security Breach

LangChain is an application built using LLM through composability. A security vulnerability exists in LangChain versions prior to 0.0.61 that stems from a security issue in the code that forces users to opt-in...

CVE-2024-38459

The langchain_experimental (LangChain Experimental) package, prior to version 0.0.61 , is vulnerable to unauthorized code execution because it provides Python REPL access without requiring an opt-in step. This issue persists due to an incomplete fix for CVE-2024-27444 . Exploitation details and s...

Denial Of Service (DoS)

langchain is vulnerable to a Denial-of-Service DoS. The vulnerability is due to infinite recursion in the parsesitemap method, which results in an infinite loop that exceeds the maximum recursion depth in Python...

Deserialization Of Untrusted Data

mlflow is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused by a lack of validation in the loadfrompickle function in the mlflow/langchain/utils.py file, allowing an attacker to execute arbitrary code on the victim's system through a malicious Langchain AgentExecutor...

BIT-MLFLOW-2024-37058

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever

A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet...

GHSA-Q25C-C977-4CMH Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever

A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +329 more potentially affected by CVE-2024-2965 via langchain-community (>=0.0.1, <=0.2.4)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.1.0, =0.0.6.dev1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.19.0, =0.1.0, =0.1.4 and more Source cves: CVE-2024-2965 Source advisory: GHSA-3HJH-JH2H-VRG6...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +603 more potentially affected by CVE-2024-2965 via langchain (>=0.0.27, <=0.2.4)

langchain PYPI version =0.0.27, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.52 and more Source cves: CVE-2024-2965 Source advisory: GHSA-3HJH-JH2H-VRG6...

Denial of service in langchain-community

Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap...