Homepage
About Snyk

Server-Side Request Forgery (SSRF) Affecting langchain-community package, versions [,0.0.27)

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.06% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-LANGCHAINCOMMUNITY-6421036
  • published 12 Mar 2024
  • disclosed 1 Mar 2024
  • credit bayuncao
Report a new vulnerability Found a mistake?

Introduced: 1 Mar 2024

CVE-2024-2057 Open this link in a new tab
CWE-918 Open this link in a new tab

How to fix?

Upgrade langchain-community to version 0.0.27 or higher.

Overview

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to the load_local function. An attacker can perform actions on behalf of the server or access unauthorized information by sending crafted requests to the vulnerable function.

CVSS Scores

version 3.1
Expand this section

Snyk

6.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    Low
  • Availability (A)
    Low