CriticalVulnerabilityLLM-specific
GHSA-8h5w-f6q9-wg35: Langchain SQL Injection vulnerability
- Identifiers
- CVE-2023-32785GHSA-8h5w-f6q9-wg35
- Published
- Record updated
- Affected
- langchain < 0.0.247
- Fixed in
- 0.0.247
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
LangChain versions before 0.0.247 are affected by a flaw in the SQL chain. Prompt injection allows an attacker to execute arbitrary code against the SQL service that the chain provides.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langchainPyPILLM dependency since 2022-10-25 · 30 tracked dependents
Related items
- HighCVE-2026-106119: LangChain MongoDBChatMessageHistory query injection via session identifierSame vendor · NVD/CVE Database
- LowGHSA-5x6v-p487-7qh2: LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesSame vendor · GitHub Advisory Database
- HighGHSA-fvww-7h3r-vfhp: LangGraph SDK custom auth silently ignores actions= on resource decoratorsSame vendor · GitHub Advisory Database
- HighCVE-2026-72848: SitemapLoader nested sitemap entries bypass restrict_to_same_domainSame vendor · NVD/CVE Database
- HighGHSA-533j-2v4q-mw5h: LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureSame vendor · GitHub Advisory Database