CVE-2024-5998: Deserialization of Untrusted Data in langchain-ai/langchain
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects versions prior to 0.2.4.
Other sources
A vulnerability in the FAISS.deserializefrombytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5998?
CVE-2024-5998 is rated as a high severity vulnerability due to the risk of arbitrary command execution.
How do I fix CVE-2024-5998?
To fix CVE-2024-5998, upgrade the langchain-community package to version 0.2.4 or later.
What software is affected by CVE-2024-5998?
CVE-2024-5998 affects versions of langchain-ai/langchain prior to 0.2.4.
What type of vulnerability is CVE-2024-5998?
CVE-2024-5998 is a deserialization vulnerability that allows for execution of arbitrary commands.
Can CVE-2024-5998 be exploited remotely?
Yes, CVE-2024-5998 can potentially be exploited remotely if untrusted data is deserialized.