AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

LangChainGHSA-655w-fm8m-m478

LangChain Server Side Request Forgery vulnerability

LangChain

CVE-2023-46229 · Published Oct 19, 2023 · updated Sep 30, 2024

High8.8
Fix: upgrade to 0.0.317 or later
GitHub advisory

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

Affected versions

PackageAffectedFixed in
langchain
PyPI
< 0.0.3170.0.317
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-918
Also known as
CVE-2023-46229, PYSEC-2023-205

More LangChain advisories

All LangChain
Critical 9.8Oct 21, 2023Langchain SQL Injection vulnerabilityCVE-2023-32785fixed in 0.0.247High 7.5Oct 21, 2023Langchain Server-Side Request Forgery vulnerabilityCVE-2023-32786fixed in 0.0.329Critical 9.8Oct 9, 2023langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec methodCVE-2023-44467no fix yetCritical 9.8Sep 1, 2023Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr libraryCVE-2023-39631fixed in 0.0.308Critical 9.8Aug 22, 2023langchain vulnerable to arbitrary code executionCVE-2023-36281fixed in 0.0.312Critical 9.8Aug 15, 2023LangChain vulnerable to arbitrary code executionCVE-2023-38896fixed in 0.0.236