{"action":"Upgrade langchain to 0.0.236 or later.","affected":[{"fixed":"0.0.236","introduced":"0"}],"component":"langchain","cve_ids":["CVE-2023-36095"],"ecosystem":"PyPI","epss":0.0117,"exploited":false,"fixed_versions":["0.0.236"],"ghsa_id":"GHSA-gwqq-6vq7-5j86","id":"tcs_01M5KFJECFWG0KZ6TWF8C31TQ1","modified_at":"2024-09-27T18:01:36.035324Z","published_at":"2023-08-05T03:30:19Z","references":["https://osv.dev/vulnerability/GHSA-gwqq-6vq7-5j86","https://nvd.nist.gov/vuln/detail/CVE-2023-36095","https://github.com/langchain-ai/langchain/issues/5872","https://github.com/langchain-ai/langchain/pull/6003","https://github.com/langchain-ai/langchain/pull/7870","https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137","https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e","https://github.com/hwchase17/langchain","https://github.com/langchain-ai/langchain","https://github.com/langchain-ai/langchain/commits/v0.0.236?after=4d8b48bdb3f17c764c5c2e3c7140071603869e74+34&branch=v0.0.236&qualified_name=refs%2Ftags%2Fv0.0.236","https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-138.yaml","http://langchain.com"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-gwqq-6vq7-5j86","url":"https://osv.dev/vulnerability/GHSA-gwqq-6vq7-5j86"}],"summary":"langchain Code Injection vulnerability"}