SOURCE-LINKED INTELLIGENCE

PYSEC-2024-323: A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function.

OSV AI package advisories · observation · Sep 17, 2024 · UTC

A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.

Read original source ↗ Open in workspace

recordType: vulnerability
status: active
evidenceStatus: reported
region: Global

Evidence & attribution

OSV AI package advisories · 2024-09-17T12:15:02.977Z

First collected: 2026-09-19T20:26:55.867Z. This is not the publication date.