CVE - CVE-2024-41950

CVE-ID
CVE-2024-41950	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. The vulnerability has been fixed with Haystack `2.3.1`.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/deepset-ai/haystack/commit/3fed1366c448b02189851bf08166c1f6477a02b0 URL:https://github.com/deepset-ai/haystack/commit/3fed1366c448b02189851bf08166c1f6477a02b0 MISC:https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e URL:https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e MISC:https://github.com/deepset-ai/haystack/pull/8095 URL:https://github.com/deepset-ai/haystack/pull/8095 MISC:https://github.com/deepset-ai/haystack/pull/8096 URL:https://github.com/deepset-ai/haystack/pull/8096 MISC:https://github.com/deepset-ai/haystack/releases/tag/v2.3.1 URL:https://github.com/deepset-ai/haystack/releases/tag/v2.3.1 MISC:https://github.com/deepset-ai/haystack/security/advisories/GHSA-hx9v-6r9f-w677 URL:https://github.com/deepset-ai/haystack/security/advisories/GHSA-hx9v-6r9f-w677
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240724	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240724)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)