azure-search-openai-demo
azure-search-openai-demo copied to clipboard
Known security vulnerability in LangChain library
Dear All, original repo set requirements for langchain library to 0.0.78. Unfortunately, it's vulnerable to prompt injection attacks as can be verified through this reference in NIST vulnerabilities database: https://nvd.nist.gov/vuln/detail/CVE-2023-29374. It was patched only from v0.0.132, so suggested it as a minimum.
Purpose
- Known security vulnerability
Does this introduce a breaking change?
[ ] Yes
[x] No - Needs to be tested though
Pull Request Type
What kind of change does this Pull Request introduce?
[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[x] Other... Please describe: Security
How to Test
- Get the code
git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install
- Test the code
What to Check
Verify that the following are valid
- https://nvd.nist.gov/vuln/detail/CVE-2023-29374