CVE-2023-34540

CriticalCVSS 9.8

Published: 14/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.68%

74th percentile - higher than 74% of all known CVEs

Summary

Langchain versions before v0.0.225 contain a remote code execution (RCE) vulnerability in the JiraAPIWrapper component. This vulnerability allows attackers to execute arbitrary code via crafted input.

Risk Assessment

This vulnerability poses a significant risk to organizations, allowing attackers to execute code remotely, potentially leading to data loss or system takeover.

Recommendation

It is recommended to upgrade to Langchain version v0.0.225 or later to mitigate this vulnerability.

Original NVD description (English source)

Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.