AI Prompt Injection Vulnerability
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
STABLE
What Happened
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
Why This Matters
The evidence matters to defenders using the affected technology because it may let untrusted content influence connected tools or sensitive workflows.
Recommended Action
Read the linked source. Identify named vendors, products, or environments and check whether they overlap with yours. Do not wait for a CVE if the report already describes exploitation or a vendor response.
Exposure
Exposure unknown
Oct 21, 2023 06:00
Exposure reason: This incident does not currently match a technology in My Interests.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Oct 21, 2023 06:00BugSkan first recorded this incident.
-
Langchain Server-Side Request Forgery vulnerability
Oct 21, 2023 06:00GitHub Advisory Database · Vulnerability
-
Langchain Server-Side Request Forgery vulnerability
Oct 21, 2023 06:00OSV.dev · Vulnerability
Sources
GitHub Advisory Database · Oct 21, 2023 06:00
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
Open publisher sourceOSV.dev · Oct 21, 2023 06:00
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
Open publisher sourceMy Interests Match
Create an account to see which incidents overlap with your interests.