CVE-2024-5998

What it actually does

The FAISS.deserialize_from_bytes function performs unsafe pickle deserialization on attacker-controlled input, allowing the embedded __reduce__ method to invoke os.system and execute arbitrary operating system commands.

Why it matters to the business

Applications that load FAISS indexes from untrusted sources can be fully compromised, enabling attackers to run commands, exfiltrate data, or pivot within the environment; the library's widespread use in AI pipelines increases exposure across many organizations.

How an attack unfolds

An attacker crafts a malicious pickle payload that registers a callable via __reduce__ to call os.system with attacker-chosen commands, then passes the resulting bytes to deserialize_from_bytes; upon deserialization the payload executes immediately with the privileges of the calling process.

How to fix it

Upgrade langchain-ai/langchain to a version containing commit 604dfe2d99246b0c09f047c604f0c63eafba31e7 (0.2.10 or newer) so that deserialize_from_bytes no longer performs unrestricted pickle loading.

How to confirm the fix worked

Confirm the installed package version is 0.2.10 or later; run a unit test that attempts to deserialize a benign FAISS index and verify no unexpected command execution occurs; scan dependency manifests for any pinned older versions.

Typical attack path

1. Identify an application endpoint or configuration that accepts or loads FAISS index data from an external or user-controlled source.
2. Generate a pickle object containing a __reduce__ entry that executes arbitrary commands via os.system.
3. Serialize the object and supply it to deserialize_from_bytes.
4. Observe command execution and use the resulting access to establish persistence or move laterally.

How to detect it

Search application and system logs for invocations of deserialize_from_bytes followed immediately by unusual os.system or subprocess activity; inspect process creation events for shells or commands launched from the Python interpreter hosting the langchain process.

• deserialize_from_bytes
• FAISS.deserialize_from_bytes
• os.system(

What your security team should do

• Immediately upgrade all instances of langchain-ai/langchain to 0.2.10 or newer.
• Replace any use of deserialize_from_bytes with a safe loader that only accepts trusted, signed index files.
• Add runtime monitoring for unexpected child processes spawned from the application process.
• Review all code paths that load serialized AI artifacts from external sources and require explicit trust boundaries.