CVE-2023-32785: Langchain SQL Injection vulnerability

October 21, 2023 (updated October 27, 2026)

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

References

gist.github.com/rharang/9c58d39db8c01db5b7c888e467c0533f
github.com/advisories/GHSA-8h5w-f6q9-wg35
github.com/langchain-ai/langchain/issues/5923
github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2026-372.yaml
nvd.nist.gov/vuln/detail/CVE-2023-32785
pypi.org/project/langchain

Code Behaviors & Features

Detect and mitigate CVE-2023-32785 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →