Skip to content
OpenAdvisories

Package · PyPI

langchain-community

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.9
    CVE-2024-8309 Public exploit EPSS 14%

    SQL Injection in langchain-ai/langchain

    A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting al…

    langchain-ai langchain-ai/langchain langchain langchain-community PyPI
  • Medium 5.2
    CVE-2024-5998

    Deserialization of Untrusted Data in langchain-ai/langchain

    A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version o…

    langchain-ai langchain-ai/langchain langchain langchain-community PyPI
  • Medium 4.2
    CVE-2024-2965

    Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain

    A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infi…

    langchain-ai langchain-ai/langchain langchain langchain-community PyPI
  • Medium 4.8
    CVE-2024-3095 Public exploit

    SSRF in Langchain Web Research Retriever in langchain-ai/langchain

    A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, all…

    langchain-ai langchain-ai/langchain langchain-community PyPI
  • Medium 6.3
    CVE-2024-2057 Public exploit

    LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

    A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation …

    @langchain langchain_community langchain-community PyPI