The XMLOutputParser in LangChain uses the etree module from the XML parser in the standard python library which has some XML vulnerabilities; see: https://docs.python.org/3/library/xml.html
This primarily affects users that combine an LLM (or agent) with the `XMLOutputParser` and expose the component via an endpoint on a web-service.
This would allow a malicious party to attempt to manipulate the LLM to produce a malicious payload for the parser that would compromise the availability of the service.
A successful attack is predicated on:
1. Usage of XMLOutputParser
2. Passing of malicious input into the XMLOutputParser either directly or by trying to manipulate an LLM to do so on the users behalf
3. Exposing the component via a web-service
References
Configurations
No configuration.
History
21 Nov 2024, 08:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3 - | |
| References | () https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6 - |
26 Mar 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-26 14:15
Updated : 2024-11-21 08:50
NVD link : CVE-2024-1455
Mitre link : CVE-2024-1455
CVE.ORG link : CVE-2024-1455
JSON object : View
Products Affected
No product.
CWE
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')