VulnWatch VulnWatch
← Back to dashboard
Medium osv ยท GHSA-f2jm-rw3h-6phg

LangChain pickle deserialization of untrusted data

Published Sep 17, 2024 CVSS 4.0
A vulnerability in the `FAISS.deserialize_from_bytes` function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the `os.system` function. The issue affects versions prior to 0.2.4.

Affected AI Products

langchain-community