CodexGuild Knowledge Base

Langchain OS Command Injection vulnerability

as of Jun 14, 2023 · applies to langchain < 0.0.225 · canonical · codexguild.com/kb/ghsa-x32c-59v5-h7fg · exported 2026-10-11

Canonical as of Jun 14, 2023

Langchain OS Command Injection vulnerability

Critical severity. Affects langchain < 0.0.225. Upgrade to 0.0.225 or later.

CVE-2023-34540 / GHSA-x32c-59v5-h7fg · severity: critical · CVSS 9.8 · PyPI

Affected

langchain < 0.0.225 → fixed in 0.0.225

Details

Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.

Source: GHSA-x32c-59v5-h7fg — GitHub Advisory Database (CC-BY-4.0).