{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.0.131"}],"component":"langchain","cve_ids":["CVE-2023-29374"],"ecosystem":"PyPI","epss":0.39653,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fprp-p869-w6q2","id":"tcs_01M5KFFS7S88RDYV1J4E0YDEYD","modified_at":"2025-02-12T18:43:20.461717Z","published_at":"2023-04-05T03:30:17Z","references":["https://osv.dev/vulnerability/GHSA-fprp-p869-w6q2","https://nvd.nist.gov/vuln/detail/CVE-2023-29374","https://github.com/hwchase17/langchain/issues/1026","https://github.com/hwchase17/langchain/issues/814","https://github.com/hwchase17/langchain/pull/1119","https://github.com/langchain-ai/langchain","https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-18.yaml","https://twitter.com/rharang/status/1641899743608463365/photo/1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fprp-p869-w6q2","url":"https://osv.dev/vulnerability/GHSA-fprp-p869-w6q2"}],"summary":"LangChain vulnerable to code injection"}