logo

Database

OS Command Injection In langchain

Description

Langchain OS Command Injection vulnerability Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-345402. NVD-2023-345403. OSV-2023-345404. GCVE-2023-34540

References

1. https://github.com/hwchase17/langchain/issues/48332. https://github.com/langchain-ai/langchain/issues/48333. https://github.com/langchain-ai/langchain/pull/69924. https://github.com/langchain-ai/langchain/commit/a2f191a32229256dd41deadf97786fe41ce04cbb5. https://github.com/langchain-ai/langchain/releases/tag/v0.0.2256. https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-91.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.