logo

Database

Server side template injection In langchain

Description

langchain vulnerable to arbitrary code execution An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter. This is related to __subclasses__ or a template.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-362812. NVD-2023-362813. OSV-2023-362814. GCVE-2023-36281

References

1. https://github.com/hwchase17/langchain/issues/43942. https://github.com/langchain-ai/langchain/pull/102523. https://github.com/langchain-ai/langchain/commit/22abeb9f6cc555591bf8e92b5e328e43aa07ff6c4. https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e555. https://github.com/langchain-ai/langchain/releases/tag/v0.0.3126. https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-151.yaml7. https://github.com/tagomaru/CVE-2023-36281

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.