CVE-2023-36189

Description

SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533f ↗
• https://github.com/hwchase17/langchain/issues/5923 ↗
• https://github.com/hwchase17/langchain/pull/6051 ↗
• https://github.com/langchain-ai/langchain/issues/5923#issuecomment-1696053841 ↗