CVE-2023-36189

EUVD-2023-0111
SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
Affected Products (NVD)
VendorProductVersion
langchainlangchain
0.0.64
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533f
https://github.com/hwchase17/langchain/issues/5923
https://github.com/hwchase17/langchain/pull/6051
https://github.com/langchain-ai/langchain/issues/5923#issuecomment-1696053841
https://gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533f
https://github.com/hwchase17/langchain/issues/5923
https://github.com/hwchase17/langchain/pull/6051
https://github.com/langchain-ai/langchain/issues/5923#issuecomment-1696053841