LangChain CVE-2024-58340

Exploitation requires that the target application uses LangChain's MRKL agent and passes attacker-influenceable text into MRKLOutputParser.parse() - most realistically via indirect/prompt-injection channels where the attacker shapes the LLM's output rather than calling the parser directly. The affected feature is specifically the MRKL output parser in langchain <= 0.3.1; applications using structured/JSON tool-calling agents or other parsers are not affected. Limiting factors: the crafted payload must reach the parser (an attacker with no path to influence parsed text cannot trigger it), the impact is availability-only (no data disclosure or code execution), and effective payloads generally need enough length to force catastrophic backtracking, so input-length limits or parse timeouts materially reduce risk.

The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and VA:H but VC:N/VI:N - impact is confined to availability, with no confidentiality or integrity loss. Signals conflict on true priority: the CVSS is high and public exploit code exists, but EPSS is only 0.08% (23rd percentile) and there is no KEV listing, suggesting real-world mass exploitation is unlikely and any attack would be targeted rather than opportunistic. Importantly, the PR:N/network rating assumes an attacker can get crafted text to the parser; in practice this usually requires an indirect prompt-injection path (the attacker influences LLM output that the app forwards into the parser) rather than a direct exposed endpoint, so exploitability depends heavily on how the downstream application is built. Net: a genuine availability risk worth patching for anyone running MRKL agents on attacker-influenced input, but not an emergency for most deployments given the DoS-only impact and low EPSS.

In an app that lets users chat with a MRKL agent, an attacker embeds a prompt-injection payload (for example in a document or web page the agent will read) that steers the LLM into emitting a specially crafted string; when the application feeds that output into MRKLOutputParser.parse(), the backtracking regex spikes CPU and hangs the request. Repeating this ties up worker threads and degrades or denies service for other users. Public exploit code is referenced in the huntr bounty, lowering the effort required.