What is GHSA-6h8p-4hx9-w66c?

GHSA-6h8p-4hx9-w66c is a security advisory published by GitHub Security Advisories with High severity. Langchain Server-Side Request Forgery vulnerability

Which CVE IDs does GHSA-6h8p-4hx9-w66c cover?

GHSA-6h8p-4hx9-w66c covers the following CVE IDs: CVE-2023-32786. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6h8p-4hx9-w66c?

GHSA-6h8p-4hx9-w66c has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-6h8p-4hx9-w66c?

GHSA-6h8p-4hx9-w66c affects 1 product, including: pip/langchain:\u003c 0.0.329.

GHSA-6h8p-4hx9-w66cHighCVSS 7.5

Langchain Server-Side Request Forgery vulnerability

Vendor

GitHub Security Advisories

Published

October 21, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-32786 →

📋 Description

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

🎯 Affected products1

pip/langchain:< 0.0.329

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-32786
https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1
https://github.com/langchain-ai/langchain/pull/12747
https://github.com/langchain-ai/langchain/releases/tag/v0.0.329
https://github.com/advisories/GHSA-6h8p-4hx9-w66c