A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle
    deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system
    function. The issue affects the latest version of the product. (CVE-2024-5998)

The version of LangChain installed on the remote host is prior to 0.2.9. It is, therefore, affected by a deserialization vulnerability in the FAISS.deserialize_from_bytes function. This can lead to the execution of arbitrary commands via the os.system function.

    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host contains a langchain version that is prior to 0.2.4. It is, therefore, affected by a vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain which allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
414202	SCA: security update for langchain-community (GHSA-f2jm-rw3h-6phg)	Tenable Cloud Security	SCA Checks	high
414202	SCA: security update for langchain-community (GHSA-f2jm-rw3h-6phg)	Tenable Self-Hosted Container Security	SCA Checks	high
213561	LangChain < 0.2.9 Vulnerability - CVE-2024-5998	Nessus	Artificial Intelligence	high
209519	LangChain < 0.2.4 RCE	Nessus	Artificial Intelligence	high

Detections

Analytics

CVE-2024-5998

high

Tenable Plugins

high

high

high

high