CVE-2023-1712 Use of Hard-coded, Security-relevant Constants in deepset-ai/haystack
Attackers can exploit hard-coded security constants in the Haystack library to bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1712?
CVE-2023-1712 is a critical vulnerability in deepset-ai/haystack, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.
Weakness: CWE-547
Which versions are affected by CVE-2023-1712?
3 open source packages ship an affected version, including farm-haystack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
farm-haystack PyPI | All versions to 1.15.0 | None |
farm-haystack PyPI | All versions to 1.15.0 | None |
farm-haystack PyPI | All versions to 1.15.0 | None |
Products include Deepset Haystack.
How do I fix CVE-2023-1712?
No fix has been published for CVE-2023-1712 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-1712 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1712 exists.
Sources
Also known as GHSA-w7qg-j435-78qw, PYSEC-2026-337.