Incident Archive: 2023

Langchain 0.0.171 is vulnerable to Arbitrary code execution in `load_prompt`.

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Evidence indicates that SQL Injection is affected by a security issue.