critical vulnerability

Langchain SQL Injection vulnerability

Fix availableCritical · CVSS 9.8

Published Oct 21, 2023 · updated Oct 27, 2026

What to do

Upgrade to a fixed version: langchain 0.0.247.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIlangchain37,479,965 downloads/week

Vulnerable versions: < 0.0.247
Fixed in: 0.0.247

Check your project: pip show langchain

Sources

GitHub Advisory GHSA-8h5w-f6q9-wg35
NVD CVE-2023-32785

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') · CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

← All critical vulnerabilities