Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hdc6-zar9-zkf2
Vulnerability ID VCID-hdc6-zar9-zkf2
Aliases CVE-2024-5998
GHSA-f2jm-rw3h-6phg
Summary LangChain pickle deserialization of untrusted data A vulnerability in the `FAISS.deserialize_from_bytes` function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the `os.system` function. The issue affects versions prior to 0.2.10.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-502 Deserialization of Untrusted Data
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2024-5998
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2024-5998
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-f2jm-rw3h-6phg
cvssv3.1 5.2 https://github.com/langchain-ai/langchain
cvssv4 8.4 https://github.com/langchain-ai/langchain
generic_textual HIGH https://github.com/langchain-ai/langchain
cvssv3 5.2 https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
cvssv3.1 5.2 https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
cvssv4 8.4 https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
generic_textual HIGH https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
ssvc Track https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
cvssv3.1 5.2 https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
cvssv4 8.4 https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
generic_textual HIGH https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
cvssv3 5.2 https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
cvssv3.1 5.2 https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
cvssv4 8.4 https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
generic_textual HIGH https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
ssvc Track https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
cvssv3.1 5.2 https://nvd.nist.gov/vuln/detail/CVE-2024-5998
cvssv4 8.4 https://nvd.nist.gov/vuln/detail/CVE-2024-5998
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-5998
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-5998
https://github.com/langchain-ai/langchain
https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
CVE-2024-5998 https://nvd.nist.gov/vuln/detail/CVE-2024-5998
GHSA-f2jm-rw3h-6phg https://github.com/advisories/GHSA-f2jm-rw3h-6phg
No exploits are available.
Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/langchain-ai/langchain
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/langchain-ai/langchain
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-17T13:28:59Z/ Found at https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/langchain-ai/langchain/commit/77209f315efd13442ec51c67719ba37dfaa44511
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L Found at https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L Found at https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-17T13:28:59Z/ Found at https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe
Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-5998
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-5998
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.25642
EPSS Score 0.0009
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:22:16.551055+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/langchain/CVE-2024-5998.yml 38.6.0