langchain-ai/langchain · Security
Langchain Server-Side Request Forgery vulnerability
- GHSA ID
- GHSA-6h8p-4hx9-w66c
- CVE ID
- CVE-2023-32786
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-918 · Server-Side Request Forgery (SSRF)