PT-2023-26641 · Langchain · Langchain

Boazwasserman · Publicado 2023-08-15 · Atualizado 2023-08-22 · CVE-2023-38860

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LangChain versions 0.0.231 through 0.0.246

Description An issue in LangChain allows a remote attacker to execute arbitrary code via the prompt parameter. This enables the attacker to potentially gain control over the system, leading to severe consequences.

Recommendations For LangChain versions 0.0.231 through 0.0.246, update to version 0.0.247 or later to resolve the issue. As a temporary workaround, consider restricting access to the prompt parameter to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-38860

GHSA-FJ32-Q626-PJJC

PYSEC-2023-145

Produtos afetados

Langchain

Referências · 14

• 🔥 https://github.com/hwchase17/langchain/issues/7641 · Exploit
• https://github.com/hwchase17/langchain · Nota
• https://github.com/langchain-ai/langchain/issues/7641 · Nota
• https://github.com/langchain-ai/langchain/commit/d353d668e4b0514122a443cef91de7f76fea4245 · Nota
• https://github.com/langchain-ai/langchain/commit/fab24457bcf8ede882abd11419769c92bc4e7751 · Nota
• https://github.com/langchain-ai/langchain/pull/8425 · Nota
• https://github.com/langchain-ai/langchain/pull/8092 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-145.yaml · Nota
• https://osv.dev/vulnerability/GHSA-fj32-q626-pjjc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38860 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-38860 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-145 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1691493234520862722 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1691521716168581120 · Publicação no Twitter