SB2026062328 - IBM Watson Speech Services Cartridge update for LangChain

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026062328

SB2026062328 - IBM Watson Speech Services Cartridge update for LangChain

Published: June 23, 2026

Security Bulletin ID SB2026062328
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper input validation (CVE-ID: CVE-2026-40087)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in DictPromptTemplate and ImagePromptTemplate when processing untrusted f-string template strings during formatting. A remote attacker can supply a specially crafted template containing attribute access or indexing expressions to disclose sensitive information.

Only applications that accept untrusted template strings are affected, and practical impact depends on richer Python objects being passed into template formatting.


Remediation

Install update from vendor's website.

References