{"data":{"id":"362b9e4c-ecdc-49e0-a1ad-8dccc481881a","title":"CVE-2024-5998: A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle…","summary":"CVE-2024-5998 affects the FAISS.deserialize_from_bytes function in langchain-ai/langchain, which allows pickle deserialization of untrusted data. The issue affects the latest version of the product, and it can lead to the execution of arbitrary commands via the os.system function. The weakness is classified as CWE-502, Deserialization of Untrusted Data.","solution":"The source links a patch in the langchain-ai/langchain commit 604dfe2d99246b0c09f047c604f0c63eafba31e7, but it does not state a fixed version or a configuration change.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-5998","publishedAt":"2024-09-17T16:15:02.977Z","cveId":"CVE-2024-5998","cweIds":["CWE-502"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-community@< 0.2.4 (fixed: 0.2.4)"],"affectedPackageNames":["langchain-community"],"affectedPackageRefs":["pypi:langchain-community"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","FAISS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain FAISS.deserialize_from_bytes unsafe pickle deserialization","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00361,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-f2jm-rw3h-6phg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:15.557Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-06-07T00:57:33.897Z","daysToFix":-102,"fixCheckedAt":"2026-10-29T21:45:30.555Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain-community","fixedVersion":"0.2.4","matchedVersion":"0.2.4","fixReleasedAt":"2024-06-07T00:57:33.897Z","daysToFix":-102,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:30.403Z"}]}}