Vulnerabilities for langchain

First version without a known vulnerability: 1.3.9

Details

• GHSA-gr75-jv2w-46562026-06-16

  LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

  Fixed in: 1.3.9, 1.4.6

• GHSA-3644-q5cj-c5c72026-05-13

  LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

  Fixed in: 0.8.0, 0.6.0, 1.0.7, 0.3.30

• GHSA-45pg-36p6-83v92024-10-29

  Langchain SQL Injection vulnerability

  Fixed in: 0.2.19, 0.2.0

• PYSEC-2024-3232024-09-17

  A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

  Fixed in: 0.2.9

• GHSA-3hjh-jh2h-vrg62024-06-06

  Denial of service in langchain-community

  Fixed in: 0.2.5, 73c42306745b0831aa6fe7fe4eeb70d2c2d87a82

• GHSA-rgp8-pm28-37592024-04-16

  langchain vulnerable to path traversal

  Fixed in: 0.0.353

• GHSA-h59x-p739-982c2024-03-04

  LangChain directory traversal vulnerability

  Fixed in: 0.0.339, 0.1.30, 0.1.11

• GHSA-h9j7-5xvc-qhg52024-02-26

  langchain Server-Side Request Forgery vulnerability

  Fixed in: 0.1.0

• GHSA-6h8p-4hx9-w66c2023-10-21

  Langchain Server-Side Request Forgery vulnerability

  Fixed in: 0.0.329

• GHSA-8h5w-f6q9-wg352023-10-21

  Langchain SQL Injection vulnerability

  Fixed in: 0.0.247

• GHSA-655w-fm8m-m4782023-10-19

  LangChain Server Side Request Forgery vulnerability

  Fixed in: 0.0.317, 9ecb7240a480720ec9d739b3877a52f76098a2b8

• GHSA-f73w-4m7g-ch9x2023-09-01

  Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library

  Fixed in: 0.0.308, 2.8.5

• GHSA-7gfq-f96f-g85j2023-08-22

  langchain vulnerable to arbitrary code execution

  Fixed in: 0.0.312, 0.0.171

• GHSA-92j5-3459-qgp42023-08-15

  LangChain vulnerable to arbitrary code execution

  Fixed in: 0.0.236, 0.0.195

• GHSA-fj32-q626-pjjc2023-08-15

  LangChain vulnerable to arbitrary code execution

  Fixed in: 0.0.247

• GHSA-prgp-w7vf-ch622023-08-15

  LangChain vulnerable to arbitrary code execution

  Fixed in: 0.0.325, 0.0.233

• GHSA-gwqq-6vq7-5j862023-08-05

  langchain Code Injection vulnerability

  Fixed in: 0.0.236

• GHSA-57fc-8q82-gfp32023-07-06

  langchain vulnerable to arbitrary code execution

  Fixed in: 0.0.247

• GHSA-7q94-qpjr-xpgm2023-07-06

  langchain SQL Injection vulnerability

  Fixed in: 0.0.247

• GHSA-2qmj-7962-cjq82023-07-03

  langchain arbitrary code execution vulnerability

  Fixed in: 0.0.247

• GHSA-6643-h7h5-x9wh2023-06-20

  Langchain vulnerable to arbitrary code execution

  Fixed in: 0.0.247

• GHSA-x32c-59v5-h7fg2023-06-14

  Langchain OS Command Injection vulnerability

  Fixed in: 0.0.225

• GHSA-fprp-p869-w6q22023-04-05

  LangChain vulnerable to code injection

  Fixed in: 0.0.132