CVE-2024-5998

Advisory

A critical security vulnerability affects the FAISS class in the langchain-ai/langchain library. The deserialize_from_bytes method deserializes data using Python's pickle module without proper security checks, potentially allowing attackers to execute arbitrary code, including system commands via os.system. Users must update to the latest version, which introduces an allow_dangerous_deserialization parameter. Users must explicitly set this parameter to True to allow deserialization, acknowledging the risk. Never deserialize data from untrusted sources.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-f2jm-rw3h-6phg
• https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5998