Technology
LangChain
-
REVIEW
Historical advisory: prompt injection could manipulate LangChain graph queries
GraphCypherQAChain connects model output to database operations; permissions matter alongside dependency updates.
-
REVIEW
Historical advisory: LangChain LocalFileStore paths could escape their directory
The LocalFileStore issue concerns filesystem boundaries around user-influenced paths.
-
REVIEW
Historical advisory: LangChain configuration paths could escape the intended repository
The affected component is LangChain configuration loading, not GitHub itself.
-
REVIEW
Historical advisory: LangChain prompt injection could trigger server-side requests
CVE-2023-32786 concerns attacker-influenced URL retrieval in older LangChain releases.
-
REVIEW
Historical advisory: prompt injection could reach LangChain SQL services
A separate 2023 LangChain advisory links prompt injection to execution against a connected SQL service.
-
REVIEW
Historical advisory: LangChain SQLDatabaseChain could expose database information
CVE-2023-36189 concerns SQL injection through SQLDatabaseChain. The model’s output should not become unrestricted database authority.
-
REVIEW
Historical advisory: LangChain prompt loading could execute untrusted code
A 2023 advisory concerns LangChain prompt loading. Review legacy deployments rather than treating it as a new incident.