PyPI/langchain CVE-2023-36095: critical 9.8, EPSS 1.17%

langchain Code Injection vulnerability

Action: Upgrade langchain to 0.0.236 or later.

pip install langchain==0.0.236

Affected

Fixed versions

Sources

• osv: GHSA-gwqq-6vq7-5j86
• https://nvd.nist.gov/vuln/detail/CVE-2023-36095
• https://github.com/langchain-ai/langchain/issues/5872
• https://github.com/langchain-ai/langchain/pull/6003
• https://github.com/langchain-ai/langchain/pull/7870
• https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137
• https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e
• https://github.com/hwchase17/langchain
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/commits/v0.0.236?after=4d8b48bdb3f17c764c5c2e3c7140071603869e74+34&branch=v0.0.236&qualified_name=refs%2Ftags%2Fv0.0.236
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-138.yaml
• http://langchain.com

CVE-2023-36095 · published 2023-08-05T03:30:19Z · modified 2024-09-27T18:01:36.035324Z · JSON