CVE-2024-5998

HIGH

langchain < 0.2.9 and langchain-community < 0.2.4 - Remote Code Execution via FAISS Deserialization

Title source: llm
STIX 2.1

Description

A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0036
EPSS Percentile 27.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-502
Status published
Products (2)
langchain/langchain < 0.2.9
pypi/langchain-community 0 - 0.2.4PyPI
Published Sep 17, 2024
Tracked Since Feb 18, 2026