{"data":{"id":"c0d8d007-2814-4a1d-9bb8-f55c7df0e355","title":"CVE-2023-32786: In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an…","summary":"CVE-2023-32786 affects Langchain through 0.0.155. Prompt injection in that version allows an attacker to force the service to retrieve data from an arbitrary URL, which the source describes as providing SSRF and potentially injecting content into downstream tasks. NIST has not yet provided an NVD assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-32786","publishedAt":"2023-10-21T02:15:10.553Z","cveId":"CVE-2023-32786","cweIds":["CWE-74"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["langchain@< 0.0.329 (fixed: 0.0.329)"],"affectedPackageNames":["langchain"],"affectedPackageRefs":["pypi:langchain"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langchain prompt injection enables SSRF via arbitrary URL retrieval","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00709,"epssCheckedAt":"2026-11-04T18:09:12.971Z","kevDateAdded":null,"advisoryAliases":["GHSA-6h8p-4hx9-w66c"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:44.016Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-11-02T13:07:02.919Z","daysToFix":12,"fixCheckedAt":"2026-10-29T21:46:44.502Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"rag","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"pypi","name":"langchain","fixedVersion":"0.0.329","matchedVersion":"0.0.329","fixReleasedAt":"2023-11-02T13:07:02.919Z","daysToFix":12,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:44.349Z"}]}}