~ / search / GHSA-6h8p-4hx9-w66c

GHSA-6h8p-4hx9-w66c

Langchain Server-Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-32786

Packages

EcosystemPackageAffectedFixed in
PyPI langchain < 0.0.329 0.0.329

Details

As written in the advisory (Markdown source, shown as plain text).

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

References

External links from the advisory. They lead to third-party sites.