CVE-2024-5998

Advisory

Affected versions of the langchain package are vulnerable to Deserialization of Untrusted Data due to unsafe pickle deserialization in the FAISS vector store implementation. The FAISS.deserialize_from_bytes function directly deserializes pickle data without proper validation, allowing arbitrary Python objects to be reconstructed and executed during the deserialization process.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-f2jm-rw3h-6phg
• https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5998