{"action":"Upgrade langchain to 0.0.247 or later.","affected":[{"fixed":"0.0.247","introduced":"0"}],"component":"langchain","cve_ids":["CVE-2023-36189"],"ecosystem":"PyPI","epss":0.01248,"exploited":false,"fixed_versions":["0.0.247"],"ghsa_id":"GHSA-7q94-qpjr-xpgm","id":"tcs_01M5KGJAKJJ8XGFXKYD5FDHE2T","modified_at":"2026-06-10T17:01:09.253570203Z","published_at":"2023-07-06T14:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-110","https://github.com/langchain-ai/langchain/pull/8425","https://github.com/langchain-ai/langchain/issues/5923","https://github.com/advisories/GHSA-7q94-qpjr-xpgm"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-110","url":"https://osv.dev/vulnerability/PYSEC-2023-110"}],"summary":"SQL injection vulnerability in langchain v.0.0.64 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component."}