CVE Daily

CVE-2024-5998

A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/lan...

High CVSS 7.8

Overview

A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

CWE: CWE-502 Published: 2024-09-17T12:15:02.977
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 7.8 (HIGH)
  • Detected tags: deserialization (tag impact: MODERATE)

Recommended actions:

  • Avoid untrusted deserialization; prefer safe formats (JSON) and signatures.

Recommended tools

Tags