LangChain GraphCypherQAChain code execution
Date: 2023-08
Affected: langchain-ai/langchain
Attack vector: prompt-injection
Category: real-world
Severity: Critical
CVE: CVE-2023-39631
CWE: CWE-94
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

LangChain through specific versions allows code execution through unsanitized prompt-driven Cypher queries via GraphCypherQAChain, enabling injection of arbitrary commands into the database session.


Mitigations:

Architectural layers (MAESTRO):