CVE-2023-34540

CRITICAL

langchain < 0.0.225 - Remote Code Execution via JiraAPIWrapper

Title source: llm
STIX 2.1

Description

Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0168
EPSS Percentile 74.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (2)
langchain/langchain 0.0.171
pypi/langchain 0 - 0.0.225PyPI
Published Jun 14, 2023
Tracked Since Feb 18, 2026