AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

LangChainGHSA-6h8p-4hx9-w66c

Langchain Server-Side Request Forgery vulnerability

LangChain

CVE-2023-32786 · Published Oct 21, 2023 · updated Jul 7, 2026

High7.5
Fix: upgrade to 0.0.329 or later
GitHub advisory

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Affected versions

PackageAffectedFixed in
langchain
PyPI
< 0.0.3290.0.329
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-74, CWE-918
Also known as
CVE-2023-32786, PYSEC-2026-1508

More LangChain advisories

All LangChain
Critical 9.8Oct 21, 2023Langchain SQL Injection vulnerabilityCVE-2023-32785fixed in 0.0.247High 8.8Oct 19, 2023LangChain Server Side Request Forgery vulnerabilityCVE-2023-46229fixed in 0.0.317Critical 9.8Oct 9, 2023langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec methodCVE-2023-44467no fix yetCritical 9.8Sep 1, 2023Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr libraryCVE-2023-39631fixed in 0.0.308Critical 9.8Aug 22, 2023langchain vulnerable to arbitrary code executionCVE-2023-36281fixed in 0.0.312Critical 9.8Aug 15, 2023LangChain vulnerable to arbitrary code executionCVE-2023-38896fixed in 0.0.236