CVE-2024-0243 Server-side Request Forgery In Recursive URL Loader

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

CVE-2024-0243

With the following crawler configuration: An attacker in control of the contents of "https://example.com" could place a malicious HTML file in there with links like "https://example.completely.different/myfile.html" and the crawler would proceed to download that file as well even though...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +378 more potentially affected by CVE-2024-0243 via langchain (>=0.0.27, <=0.0.354)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.0, =0.0.6.dev1, =0.1.5, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2024-0243 Source advisory: MEND:CVE-2024-0243...

CVE-2024-0243: Server-Side Request Forgery (SSRF)

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

PT-2024-15407

Name of the Vulnerable Software and Affected Versions langchain versions prior to the version that includes the fix from https://github.com/langchain-ai/langchain/pull/15559 Description The issue arises when an attacker controls the contents of a website, such as https://example.com, and places a...

langchain-couchbase (>=0.2.2.dev0, <=0.2.3.dev0) potentially affected by CVE-2023-45875 via couchbase (4.3.2)

couchbase PYPI version 4.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on couchbase and may be impacted: - langchain-couchbase =0.2.2.dev0, =0.2.3.dev0 Source cves: CVE-2023-45875 Source advisory: OSV:PYSEC-2023-235...

Server Side Request Forgery (SSRF)

langchain is vulnerable to Server Side Request Forgery SSRF. The attacker can force the service to retrieve an arbitrary url which could lead to information leak. Also can potentially inject content into downstream tasks...

SQL Injection

langchain is vulnerable to SQL Injection. The vulnerability is due to a prompt injection which allows execution of arbitrary code against the SQL service provided by the chain...

Langchain SQL Injection vulnerability

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain...

agent-actors (0.1.0), agent-lab-sdk (>=0.1.7, <=0.1.16) +183 more potentially affected by CVE-2023-32785 via langchain (>=0.0.27, <=0.0.246)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.5, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.14, =0.1.9, =0.0.33, =0.1.0a0, =0.2.0, =0.3.0 and more Source cves: CVE-2023-32785 Source advisory: OSV:GHSA-8H5W-F6Q9-WG35...

agent-actors (0.1.0), agent-lab-sdk (>=0.1.7, <=0.1.16) +183 more potentially affected by CVE-2023-32785 via langchain (>=0.0.27, <=0.0.246)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.5, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.14, =0.1.9, =0.0.33, =0.1.0a0, =0.2.0, =0.3.0 and more Source cves: CVE-2023-32785 Source advisory: GHSA-8H5W-F6Q9-WG35...

GHSA-8H5W-F6Q9-WG35 Langchain SQL Injection vulnerability

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain...

agent-actors (0.1.0), agent-lab-sdk (>=0.1.7, <=0.1.16) +292 more potentially affected by CVE-2023-32786 via langchain (>=0.0.27, <=0.0.327)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.5, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.8, =0.0.1, =0.0.14, =0.0.18 - athina 0.1.0 and more Source cves: CVE-2023-32786 Source advisory: GHSA-6H8P-4HX9-W66C...

agent-actors (0.1.0), agent-lab-sdk (>=0.1.7, <=0.1.16) +292 more potentially affected by CVE-2023-32786 via langchain (>=0.0.27, <=0.0.327)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.5, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.8, =0.0.1, =0.0.14, =0.0.18 - athina 0.1.0 and more Source cves: CVE-2023-32786 Source advisory: OSV:GHSA-6H8P-4HX9-W66C...

Langchain Server-Side Request Forgery vulnerability

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

GHSA-6H8P-4HX9-W66C Langchain Server-Side Request Forgery vulnerability

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

CVE-2023-32786

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

CVE-2023-32786

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

Code injection

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

CVE-2023-32786

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...