PT-2023-26673 · Harrison Chase · Langchain

Llm Security · Publicado 2023-08-15 · Atualizado 2023-08-22 · CVE-2023-38896

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Harrison Chase langchain versions 0.0.194 and before Harrison Chase langchain versions prior to 0.0.236

Description An issue in Harrison Chase langchain allows a remote attacker to execute arbitrary code via the from math prompt and from colored object prompt functions.

Recommendations For versions 0.0.194 and before, update to version 0.0.236 or later to resolve the issue. As a temporary workaround, consider disabling the from math prompt and from colored object prompt functions until a patch is available.

Exploit

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

CVE-2023-38896

GHSA-92J5-3459-QGP4

PYSEC-2023-146

Produtos afetados

Langchain

Referências · 14

• 🔥 https://github.com/hwchase17/langchain/issues/5872 · Exploit
• https://github.com/langchain-ai/langchain · Nota
• https://github.com/hwchase17/langchain/pull/6003 · Correção
• https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137 · Nota
• https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-146.yaml · Nota
• https://twitter.com/VulmonFeeds/status/1691522475425673216 · Publicação no Twitter
• https://t.me/cibsecurity/68554 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-92j5-3459-qgp4 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1691493236416688148 · Publicação no Twitter
• https://twitter.com/llm_sec/status/1668711587287375876 · Nota
• https://osv.dev/vulnerability/PYSEC-2023-146 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38896 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-38896 · Aviso do Fabricante