基础信息
项目名称：chatchat-space/Langchain-Chatchat
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1757331013443649536/1757331013762416640
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| NumPy 代码问题漏洞 | 空指针取消引用 | MPS-2021-32278 | CVE-2021-41495 | 中危 |
| httpx 存在输入验证不恰当漏洞 | 输入验证不恰当 | MPS-2022-14944 | 中危 | |
| LlamaIndex 安全漏洞 | SQL注入 | MPS-5dx1-t2ai | CVE-2024-23751 | 严重 |
| FastAPI 资源管理错误漏洞 | ReDoS | MPS-s9af-eg81 | CVE-2024-24762 | 高危 |
| llamaindex project注入漏洞 | 注入 | MPS-vqf1-blj0 | CVE-2023-39662 | 严重 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| llama-index | 0.9.35 | 间接依赖 | 可选修复 | |
| httpx | 0.26.0 | 间接依赖 | 可选修复 | |
| numpy | 1.24.4 | 间接依赖 | 可选修复 | |
| fastapi | 0.109.0 | 0.109.1 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| MIT | 20 | 低 |
| Apache-2.0 | 8 | 低 |
| GPL-3.0-or-later | 1 | 低 |
| BSD-3-Clause | 6 | 低 |
| Unlicense | 1 | 低 |
| BSD-2-Clause | 1 | 低 |
| Apache License 2.0 | 1 | 低 |
| MIT License | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| markdownify | 0.11.6 | 间接依赖 | pip |
| pandas | 2.0.3 | 间接依赖 | pip |
| as_completed | 间接依赖 | pip | |
| dialogue_page | 间接依赖 | pip | |
| server | 间接依赖 | pip | |
| fastchat | 间接依赖 | pip | |
| BaseResponse | 间接依赖 | pip | |
| get_file_path | 间接依赖 | pip | |
| fastapi | 0.109.0 | 间接依赖 | pip |
| requests | 2.31.0 | 间接依赖 | pip |
| arxiv | 2.1.0 | 间接依赖 | pip |
| streamlit-option-menu | 0.3.12 | 间接依赖 | pip |
| ListResponse | 间接依赖 | pip | |
| sse_starlette | 1.8.2 | 间接依赖 | pip |
| transformers_stream_generator | 0.0.4 | 间接依赖 | pip |
| numexpr | 2.8.6 | 间接依赖 | pip |
| streamlit-antd-components | 0.3.1 | 间接依赖 | pip |
| spacy | 3.7.2 | 间接依赖 | pip |
| VECTOR_SEARCH_TOP_K | 间接依赖 | pip | |
| PyMuPDF | 1.23.16 | 间接依赖 | pip |
| get_kb_path | 间接依赖 | pip | |
| dashscope | 1.13.6 | 间接依赖 | pip |
| einops | 0.7.0 | 间接依赖 | pip |
| ThreadPoolExecutor | 间接依赖 | pip | |
| NLTK_DATA_PATH | 间接依赖 | pip | |
| httpx | 0.26.0 | 间接依赖 | pip |
| starlette | 0.35.0 | 间接依赖 | pip |
| Optional | 间接依赖 | pip | |
| TEMPERATURE | 间接依赖 | pip | |
| torchvision | 0.16.2 | 间接依赖 | pip |
| tiktoken | 0.5.2 | 间接依赖 | pip |
| EMBEDDING_MODEL | 间接依赖 | pip | |
| LLM_MODELS | 间接依赖 | pip | |
| KBService | 间接依赖 | pip | |
| AgGrid | 间接依赖 | pip | |
| run_in_thread_pool | 间接依赖 | pip | |
| openai | 1.9.0 | 间接依赖 | pip |
| langchain | 0.0.354 | 间接依赖 | pip |
| streamlit-aggrid | 0.3.4.post3 | 间接依赖 | pip |
| uvicorn | 0.27.0.post1 | 间接依赖 | pip |
| TTLCache | 间接依赖 | pip | |
| torchaudio | 2.1.2 | 间接依赖 | pip |
| strsimpy | 0.2.1 | 间接依赖 | pip |
| faiss-cpu | 1.7.4 | 间接依赖 | pip |
| httpx_sse | 0.4.0 | 间接依赖 | pip |
| accelerate | 0.24.1 | 间接依赖 | pip |
| rapidocr_onnxruntime | 1.3.8 | 间接依赖 | pip |
| Dict | 间接依赖 | pip | |
| List | 间接依赖 | pip | |
| pytest | 7.4.3 | 间接依赖 | pip |
| api_address | 间接依赖 | pip | |
| metaphor-python | 0.1.23 | 间接依赖 | pip |
| websockets | 12.0 | 间接依赖 | pip |
| llama-index | 0.9.35 | 间接依赖 | pip |
| pydantic | 1.10.13 | 间接依赖 | pip |
| tqdm | 4.66.1 | 间接依赖 | pip |
| Form | 间接依赖 | pip | |
| youtube-search | 2.1.2 | 间接依赖 | pip |
| torch | 2.1.2 | 间接依赖 | pip |
| SQLAlchemy | 2.0.19 | 间接依赖 | pip |
| list_config_llm_models | 间接依赖 | pip | |
| nltk | 3.8.1 | 间接依赖 | pip |
| File | 间接依赖 | pip | |
| pathlib | 1.0.1 | 间接依赖 | pip |
| ABC | 间接依赖 | pip | |
| pyjwt | 2.8.0 | 间接依赖 | pip |
| numpy | 1.24.4 | 间接依赖 | pip |
| JsCode | 间接依赖 | pip | |
| chat_box | 间接依赖 | pip | |
| Any | 间接依赖 | pip | |
| MAX_TOKENS | 间接依赖 | pip | |
| streamlit-modal | 0.1.0 | 间接依赖 | pip |
| sentence_transformers | 2.2.2 | 间接依赖 | pip |
| transformers | 4.37.2 | 间接依赖 | pip |
| cached | 间接依赖 | pip | |
| fschat | 0.2.35 | 间接依赖 | pip |
| SupportedVSType | 间接依赖 | pip | |
| xformers | 0.0.23.post1 | 间接依赖 | pip |
| configs | 间接依赖 | pip | |
| streamlit | 1.30.0 | 间接依赖 | pip |
| sqlalchemy | 间接依赖 | pip | |
| Literal | 间接依赖 | pip | |
| streamlit-chatbox | 1.1.11 | 间接依赖 | pip |
| get_model_worker_config | 间接依赖 | pip | |
| abstractmethod | 间接依赖 | pip | |
| duckduckgo-search | 3.9.9 | 间接依赖 | pip |
| watchdog | 3.0.0 | 间接依赖 | pip |
| langchain-experimental | 0.0.47 | 间接依赖 | pip |