PT-2024-18926 · Unknown · Langchain Experimental+1

Rory Mcnamara · Published 2024-07-15 · Updated 2024-08-01 · CVE-2024-21513

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions langchain-experimental versions 0.0.15 through 0.0.21

Description The issue allows for Arbitrary Code Execution when retrieving values from the database. An attacker can exploit this by controlling the input prompt and executing arbitrary python code if the server is configured with VectorSQLDatabaseChain. This affects the confidentiality, integrity, and availability of the vulnerable component and the subsequent system. The attacker needs to influence the input prompt to exploit the issue.

Recommendations For versions 0.0.15 through 0.0.21, consider disabling the eval function or restricting access to the VectorSQLDatabaseChain plugin as a temporary workaround until a patch is available. Restricting the input prompt to prevent unauthorized control can also help minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-21513

GHSA-CGCG-P68Q-3W7V

PYSEC-2024-62

Affected Products

Vectorsqldatabasechain

Langchain Experimental

References · 12

• https://github.com/langchain-ai/langchain/commit/7b13292e3544b2f5f2bfb8a27a062ea2b0c34561 · Patch
• https://osv.dev/vulnerability/CVE-2024-21513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21513 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-62 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgcg-p68q-3w7v · Vendor Advisory
• https://github.com/langchain-ai/langchain · Note
• https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py%23L81 · Note
• https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py#L81 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain-experimental/PYSEC-2024-62.yaml · Note
• https://t.me/cvedetector/839 · Telegram Post
• https://security.snyk.io/vuln/SNYK-PYTHON-LANGCHAINEXPERIMENTAL-7278171 · Note
• https://t.me/cvenotify/86192 · Telegram Post