Skip to main content

Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
  1. Home
  2. Alerts & Advisories
  3. Alerts
  4. Multiple Vulnerabilities Affecting LangChain Gen AI
Alerts

Multiple Vulnerabilities Affecting LangChain Gen AI

24 July 2024

Palo Alto Networks researchers have identified two vulnerabilities (CVE-2023-46229 and CVE-2023-44467) in LangChain, a popular open source generative AI framework on GitHub. CVE-2023-44467 has a Common Vulnerability Scoring System (CVSSv3) score of 9.8 out of 10.

The vulnerabilities are:

  • CVE-2023-46229: A Server Side Request Forgery (SSRF) vulnerability that could allow an attacker to manipulate the server into making HTTP requests to an arbitrary domain by exploiting the server's ability to crawl from an external server to an internal server, resulting in unauthorised access to sensitive data.

  • CVE-2023-44467: A prompt injection vulnerability that could allow an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code.

The vulnerabilities affect LangChain versions prior to 0.0.317.

Users and administrators of affected product versions are advised to update to the latest version immediately.

More information is available here:

https://unit42.paloaltonetworks.com/langchain-vulnerabilities/

https://www.recordedfuture.com/vulnerability-database/CVE-2023-46229

https://www.recordedfuture.com/vulnerability-database/CVE-2023-44467

Back to top