CVE-2023-32785: Langchain SQL Injection Vulnerability
Summary
CVE-2023-32785: Langchain SQL Injection vulnerability. Affects langchain versions < 0.0.247. Fixed in 0.0.247. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langchain is an open-source framework designed for building applications that utilize language models. It provides a variety of tools and components for integrating language processing capabilities into software solutions. However, prior to version 0.0.247, Langchain was susceptible to a prompt injection vulnerability that could lead to SQL injection attacks, allowing unauthorized execution of arbitrary SQL code.
Vulnerability Detail
The vulnerability arises from improper handling of user input in Langchain's SQL service. Specifically, the prompt injection flaw enables attackers to manipulate the input prompts, which can result in the execution of arbitrary SQL commands. This can lead to severe consequences, including unauthorized data access, data manipulation, and potential compromise of the entire database. The vulnerability is particularly critical due to its high CVSS score of 9.8, indicating a significant risk to applications utilizing affected versions of Langchain.
How To Fix
Latest published version: 1.4.7 as of 22 Oct 2026
pip install --upgrade "langchain==1.4.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.247
This is the first release that contains the fix.
pip install --upgrade "langchain==0.0.247"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize and validate all user inputs before processing them through the Langchain SQL service. This can help mitigate the risk of SQL injection attacks until you can upgrade to the patched version. For example, you can implement input validation checks in your application code to ensure that only expected input formats are accepted.
Conclusion
The Langchain SQL injection vulnerability (CVE-2023-32785) poses a significant risk to applications using versions prior to 0.0.247. It is crucial for developers to update their Langchain installations to the latest version to mitigate this risk and protect their applications from potential SQL injection attacks.
See every vulnerability recorded for langchain →
FAQ
The vulnerability is a SQL injection flaw that allows attackers to execute arbitrary SQL commands through manipulated input prompts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include unauthorized access to sensitive data, data manipulation, and potential compromise of the database.
Yes, the vulnerability is fixed in Langchain version 0.0.247 and later. Updating to this version is recommended.
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for langchain.
