New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[GHSA-45pg-36p6-83v9] Langchain-Community SQL Injection vulnerability #4984

Open

eyurtsev wants to merge 1 commit into eyurtsev/advisory-improvement-4984 from eyurtsev-GHSA-45pg-36p6-83v9

+4 −5

eyurtsev commented Nov 4, 2024

Updates

Affected products
CVSS v3

Comments
langchain is structured as a mono-repo. The vulnurable code has existed only in langchain-community since version 0.2.0 of langchain.

https://github.com/langchain-ai/langchain/blob/langchain==0.2.0/libs/langchain/langchain/chains/graph_qa/cypher.py#L9


          Improve GHSA-45pg-36p6-83v9

af19fd6

hinthornw approved these changes

View reviewed changes

github-actions bot changed the base branch from main to eyurtsev/advisory-improvement-4984

November 4, 2024 19:37

efriis approved these changes

View reviewed changes

Contributor

shelbyc commented Nov 4, 2024

@eyurtsev Thanks for the clarification. Just to double check, the affected products and their affected versions should be:

langchain-community with affected version range < 0.3.0 and fixed version 0.3.0
langchain with affected version range >= 0.2.0, < 0.3.0 and fixed version 0.3.0
Are these correct?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet