In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.
Why This Matters
The evidence matters to defenders using Langchain because it could let an attacker run code in affected environments.
Recommended Action
Confirm whether before is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.
Affected
LangchainPrompt InjectionRemote Code ExecutionvulnerabilityLangchain SQL Injectionlangchain-ai/langchain