LangChain vulnerable to arbitrary code execution

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-38896 · ADVISORY
• hwchase17/langchain · WEB
• hwchase17/langchain#6003 · WEB
• langchain-ai/langchain commit 8ba9835 · WEB
• langchain-ai/langchain commit e294ba4 · WEB
• langchain-ai/langchain · PACKAGE
• pypa/advisory-database · WEB
• twitter.com/llm_sec/status/1668711587287375876 · WEB
• GitHub Advisory GHSA-92j5-3459-qgp4 · ADVISORY

langchain のその他の脆弱性

• CVE-2026-55443中 5.5LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesys…
• CVE-2026-45134高 7.1LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the La…
• CVE-2024-8309緊急 9.8A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. T…
• CVE-2024-5998高 7.8A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. …
• CVE-2024-2965中 4.7A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versio…