CVE-2023-46229

LangChain before 0.0.317 is affected by an SSRF in document_loaders/recursive_url_loader.py, enabling crawling from an external server to an internal server. The issue impacts the LangChain Python library (

CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

LangChain Code Issues Vulnerabilities

LangChain builds applications using LLM through composability. A security vulnerability exists in LangChain prior to version 0.0.317, which stems from a server-side request forgery attack via documentloaders/recursiveurlloader.py, as crawling can be performed from an external server to an interna...

CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

agent-actors (0.1.0), agent-lab-sdk (>=0.1.7, <=0.1.16) +281 more potentially affected by CVE-2023-46229 via langchain (>=0.0.27, <=0.0.316)

langchain PYPI version =0.0.27, =0.1.7, =0.2.1, =0.1.0, =0.1.5, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.8, =0.0.1, =0.0.14, =0.0.18 - athina 0.1.0 and more Source cves: CVE-2023-46229 Source advisory: MEND:CVE-2023-46229...

CVE-2023-46229: Server-Side Request Forgery (SSRF)

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

PT-2023-29915

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 0.0.317 Description The issue allows Server-Side Request Forgery SSRF via the document loaders/recursive url loader.py module. This occurs because crawling can proceed from an external server to an internal server...

Code Injection

langchain is vulnerable to Code Injection. The vulnerability is due to improper prompt santization in the PALChain. This vulnerability bypasses CVE-2023-36258...

drama-agent (>=0.1.1, <=0.1.4), kube-copilot (>=0.1.21, <=0.1.22) +2 more potentially affected by CVE-2023-44467 via langchain-experimental (>=0.0.8, <=0.0.14)

langchain-experimental PYPI version =0.0.8, =0.1.1, =0.1.21, =0.0.13, =0.0.18 - myevery 0.0.11 Source cves: CVE-2023-44467 Source advisory: GHSA-GJJR-63X4-V8CQ...

drama-agent (>=0.1.1, <=0.1.4), kube-copilot (>=0.1.21, <=0.1.22) +2 more potentially affected by CVE-2023-44467 via langchain-experimental (>=0.0.8, <=0.0.14)

langchain-experimental PYPI version =0.0.8, =0.1.1, =0.1.21, =0.0.13, =0.0.18 - myevery 0.0.11 Source cves: CVE-2023-44467 Source advisory: OSV:GHSA-GJJR-63X4-V8CQ...

GHSA-GJJR-63X4-V8CQ langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

CVE-2023-44467

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

CVE-2023-44467

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

Design/Logic Flaw

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

ceylon (>=0.2.0b1, <=0.20.0), gpt-all-star (>=0.0.52, <=0.0.54) +2 more potentially affected by CVE-2023-44467 via langchain-experimental (0.0.64)

langchain-experimental PYPI version 0.0.64 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-experimental and may be impacted: - ceylon =0.2.0b1, =0.0.52, =0.1.5, =2.4.48, =2.5.19 Source cves: CVE-2023-44467 Source advisory: OSV:PYSEC-2023-194...

archive-retriever (0.1.0), crewai (>=0.61.0, <=0.70.1) +14 more potentially affected by CVE-2023-44467 via langchain-experimental (0.0.65)

langchain-experimental PYPI version 0.0.65 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-experimental and may be impacted: - archive-retriever 0.1.0 - crewai =0.61.0, =0.1.3, =0.1.114, =0.1.120a1, =0.1.120, =0.0.48, =0.0.96.dev6, =0.3.10a5,...

drama-agent (>=0.1.1, <=0.1.4), kube-copilot (>=0.1.21, <=0.1.22) +2 more potentially affected by CVE-2023-44467 via langchain-experimental (>=0.0.8, <=0.0.14)

langchain-experimental PYPI version =0.0.8, =0.1.1, =0.1.21, =0.0.13, =0.0.18 - myevery 0.0.11 Source cves: CVE-2023-44467 Source advisory: OSV:PYSEC-2023-194...

CVE-2023-44467

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

CVE-2023-44467: Undefined Security Weakness

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

LangChain Security Breach

LangChain is used to build applications using LLM through composability. A security vulnerability exists in LangChain langchainexperimental version 0.0.14, which originated from a vulnerability that allows attackers to bypass the CVE-2023-36258 fix and execute arbitrary code via PALChain in the...