← Back

CVE-2024-5998

nvd nist
Published: Sep 17, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

Affected (1)

Products: Langchain: Langchain
Langchain
1 product
Langchain
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Langchain
Before 0.2.9

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

Source: security@huntr.dev
Patch
Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.