Fluid Attacks Database

Description

LangChain pickle deserialization of untrusted data A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects versions prior to 0.2.4.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	langchain-community	>=0 <0.2.4	0.2.4
pypi	langchain	>=0 <0.2.10	0.2.10

Aliases

1. CVE-2024-59982. NVD-2024-59983. OSV-2024-59984. GHSA-f2jm-rw3h-6phg5. GCVE-2024-5998

References

1. https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e72. https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa445113. https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe4. https://github.com/langchain-ai/langchain

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.