Live › vulnerability › CVE-2023-1712
Go to dashboardThe farm-haystack Python package (deepset Haystack) ships security-relevant values hard-coded in the source, which the advisory classes as CWE-547. The sources do not say exactly what the constant controls, but the CVSS score of 9.8 means an unauthenticated remote attacker can likely compromise the affected service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:46 UTC, 0h before NVD. All times on this page are UTC.
Teams that run farm-haystack 1.15.0 or earlier in a service that uses the hard-coded value. The sources do not say which feature or configuration uses the constant, so whether a default install is exposed is unknown. Systems on a newer release can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| farm-haystack | pypi | <= 1.15.0 | – |
| deepset haystack | vendor | < 2023-03-29 | 2023-03-29 |
pip show farm-haystack and confirm the installed version is 1.15.0 or earlier.farm-haystack pinned at <=1.15.0.farm-haystack to the release that includes commit 5fc84904f198de661d5b933fde756aa922bf09f1; the fixed version number is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1.
This page as .md · .json · in your agent: get_signal("CVE-2023-1712")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.