CVE-2024-5998CWE-502

Deserialization of Untrusted Data in langchain-ai/langchain

Medium · published September 17, 2024

CVSS v3.0
5.2
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

The record
Technical detail
CVSS v3.0
5.2 · MEDIUM
Vector
CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-09-17T11:50Z
EPSS history
Timeline
  • 17 SEP 11:50Z
    Deserialization of Untrusted Data in langchain-ai/langchain
    cvelistv5