LangChain < 0.2.4 RCE

medium Nessus Plugin ID 209519

Synopsis

The remote host contains a machine learning library that is affected by a remote code execution vulnerability.

Description

The remote host contains a langchain version that is prior to 0.2.4. It is, therefore, affected by a vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain which allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to LangChain 0.2.4 or later.

Plugin Details

Severity: Medium

ID: 209519

File Name: langchain_0_2_4.nasl

Version: 1.2

Type: local

Family: Artificial Intelligence

Published: 10/22/2024

Updated: 10/23/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-5998

CVSS v3

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 4.5

Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:langchain-ai:langchain

Required KB Items: installed_sw/LangChain

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/13/2024

Vulnerability Publication Date: 9/17/2024

Reference Information

CVE: CVE-2024-5998

CWE: 502

Detections

Analytics