GHSA-F2JM-RW3H-6PHG LangChain pickle deserialization of untrusted data

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects versions prior to 0.2.4...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +322 more potentially affected by CVE-2024-5998 via langchain-community (>=0.0.1, <=0.2.2)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.1.0, =0.0.6.dev1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.19.0, =0.1.0, =0.1.4 and more Source cves: CVE-2024-5998 Source advisory: OSV:GHSA-F2JM-RW3H-6PHG...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +322 more potentially affected by CVE-2024-5998 via langchain-community (>=0.0.1, <=0.2.2)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.1.0, =0.0.6.dev1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.19.0, =0.1.0, =0.1.4 and more Source cves: CVE-2024-5998 Source advisory: GHSA-F2JM-RW3H-6PHG...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +355 more potentially affected by CVE-2024-5998 via langchain-community (>=0.0.1, <=0.2.9)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.1.0, =0.0.6.dev1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.19.0, =0.1.0, =0.1.4 and more Source cves: CVE-2024-5998 Source advisory: SNYK:PYTHON-LANGCHAINCOMMUNITY-11356595...

LangChain pickle deserialization of untrusted data

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects versions prior to 0.2.4...

CVE-2024-5998

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...

PYSEC-2024-323

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +625 more potentially affected by CVE-2024-5998 via langchain (>=0.0.27, <=0.2.8)

langchain PYPI version =0.0.27, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.52 and more Source cves: CVE-2024-5998 Source advisory: OSV:PYSEC-2024-323...

CVE-2024-5998 Deserialization of Untrusted Data in langchain-ai/langchain

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...

CVE-2024-5998 Deserialization of Untrusted Data in langchain-ai/langchain

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...

CVE-2024-5998

Technical details for CVE-2024-5998 (LangChain FAISS deserialize_from_bytes) are not provided in the connected documents. Monitor official advisories for affected versions, impact, and fixes.

CVE-2024-5998

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +322 more potentially affected by CVE-2024-5998 via langchain-community (>=0.0.1, <=0.2.2)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.1.0, =0.0.6.dev1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.19.0, =0.1.0, =0.1.4 and more Source cves: CVE-2024-5998 Source advisory: MEND:CVE-2024-5998...

LangChain code-related vulnerabilities

LangChain is a LangChain open source implementation of a locally hosted chatbot dedicated to answering questions via LangChain documents. LangChain suffers from a code issue vulnerability that stems from the FAISS.deserializefrombytes function's pickle deserialization of untrustworthy data, which...

CVE-2024-5998: Deserialization of Untrusted Data

A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product...

LangChain Python Library < 0.0.317 (CVE-2023-46229)

LangChain is a framework for developing applications powered by large language models. LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server. Note that Nessus has not tested for this issue but has...

LangChain Experimental Python Library <= 0.0.14 (CVE-2023-44467)

LangChain is a framework for developing applications powered by large language models. langchainexperimental aka LangChain Experimental in LangChain = 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by...

LangChain Detection

Binary data pythonlangchaindetect.nbin...

Code Injection

langchain-experimental is vulnerable to Code Injection. The vulnerability is due to the use of 'eval' on all retrieved values from the database when the server is configured with VectorSQLDatabaseChain...

drama-agent (>=0.1.1, <=0.1.4), kube-copilot (>=0.1.21, <=0.1.22) +2 more potentially affected by CVE-2024-21513 via langchain-experimental (>=0.0.8, <=0.0.14)

langchain-experimental PYPI version =0.0.8, =0.1.1, =0.1.21, =0.0.13, =0.0.18 - myevery 0.0.11 Source cves: CVE-2024-21513 Source advisory: GHSA-CGCG-P68Q-3W7V...