CVE-2024-5998: langchain-ai langchain-ai/langchain Deserialization of Untrusted Data
Vulnerability summary
CVE-2024-5998 is a high (CVSS 7.8) Deserialization of Untrusted Data vulnerability in langchain-ai langchain-ai/langchain. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 17-09-2024PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · PypiEcosystem advisory · calculated5.2MediumCVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:LDiffers
- NVDNIST5.2MediumCVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
0.00 pp
From 0.36% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
PyPI2 products
- langchain< 0.2.9
- langchain-community< 0.2.4
Langchain1 product
- langchain< 0.2.9
Langchain-ai1 product
- langchain-ai/langchain≥ unspecified, < 0.2.9
3 vendors · 4 products
