VULNERABILITY INTELLIGENCE

CVE-2023-32786

CVSS score7.5 HIGH
EPSS probability0.71%
CISA KEVNot currently listed
Published2023-10-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Weakness classification

  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Primary references