Langchain SQL Injection vulnerability

GHSA-8h5w-f6q9-wg35 · CVE-2023-32785 · PYSEC-2026-372

Published Oct 21, 2023 · Modified Jun 29, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-32785
WEB https://github.com/langchain-ai/langchain/issues/5923#issuecomment-1696053841
WEB https://gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533f
PACKAGE https://github.com/langchain-ai/langchain

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Langchain SQL Injection vulnerability

Description

References

More PyPI vulnerabilities

Start Securing