Vulnerability · Published Sep 17, 2024 · Assigned by @huntr_ai
CVE-2024-5998Deserialization of Untrusted Data in langchain-ai/langchain
Medium 5.2
In plain English
A medium-severity unsafe deserialization in langchain-ai/langchain from langchain-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)5.2Medium
Exploit odds (30 days)0.4%top 70.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | langchain | 0.2.9 | PYSEC-2024-323 |
| PyPI | langchain-community | 0.2.4 | GHSA-f2jm-rw3h-6phg |
| PyPI | langchain-community | 0.2.4 | PYSEC-2026-1514 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| langchain-ai | langchain-ai/langchain | unspecified – before 0.2.9 |
Weakness: CWE-502 · Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L