Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/69565?format=api",
    "purl": "pkg:pypi/langchain-core@0.1.34",
    "type": "pypi",
    "namespace": "",
    "name": "langchain-core",
    "version": "0.1.34",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": false,
    "next_non_vulnerable_version": "0.3.80",
    "latest_non_vulnerable_version": "1.2.11",
    "affected_by_vulnerabilities": [],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47353?format=api",
            "vulnerability_id": "VCID-chue-k3f3-m3b9",
            "summary": "LangChain's XMLOutputParser vulnerable to XML Entity Expansion\nThe XMLOutputParser in LangChain uses the etree module from the XML parser in the standard python library which has some XML vulnerabilities; see: https://docs.python.org/3/library/xml.html\n\nThis primarily affects users that combine an LLM (or agent) with the `XMLOutputParser` and expose the component via an endpoint on a web-service.\n\nThis would allow a malicious party to attempt to manipulate the LLM to produce a malicious payload for the parser that would compromise the availability of the service.\n\nA successful attack is predicated on:\n\n1. Usage of XMLOutputParser\n2. Passing of malicious input into the XMLOutputParser either directly or by trying to manipulate an LLM to do so on the users behalf\n3. Exposing the component via a web-service",
            "references": [
                {
                    "reference_url": "https://github.com/langchain-ai/langchain",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/langchain-ai/langchain"
                },
                {
                    "reference_url": "https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3"
                },
                {
                    "reference_url": "https://github.com/langchain-ai/langchain/pull/17250",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/langchain-ai/langchain/pull/17250"
                },
                {
                    "reference_url": "https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1455",
                    "reference_id": "CVE-2024-1455",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1455"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-q84m-rmw3-4382",
                    "reference_id": "GHSA-q84m-rmw3-4382",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-q84m-rmw3-4382"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/69565?format=api",
                    "purl": "pkg:pypi/langchain-core@0.1.34",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-core@0.1.34"
                }
            ],
            "aliases": [
                "CVE-2024-1455",
                "GHSA-q84m-rmw3-4382"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-chue-k3f3-m3b9"
        }
    ],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-core@0.1.34"
}