Live › vulnerability › CVE-2023-32785
Go to dashboardThis CVE record was withdrawn as a duplicate of CVE-2023-36189 and its description was removed. The GitHub advisory GHSA-8h5w-f6q9-wg35 still lists a SQL injection in LangChain before 0.0.247 with a critical CVSS score of 9.8.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC, 0h before NVD. All times on this page are UTC.
Teams that run the Python langchain package at a version below 0.0.247 and build SQL-backed chains from user input. Projects on 0.0.247 or later, or that do not use LangChain, can skip it. The withdrawn record itself gives no details, so the affected code path comes from the GitHub advisory.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| langchain | pypi | < 0.0.247 | 0.0.247 |
langchain below 0.0.247 with pip show langchainlangchain version below 0.0.247langchain to 0.0.247 or later, following the fix for CVE-2023-36189Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-36189. Reason: This record is a duplicate of CVE-2023-36189. Notes: All CVE users should reference CVE-2023-36189 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
This page as .md · .json · in your agent: get_signal("CVE-2023-32785")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.