LearningCircuit
10443929a0
The vulnerability is in LLMSymbolicMathChain which uses eval(). We only use SemanticChunker which is safe - it doesn't use eval(). Added .safety-policy.yml with documented justification and 6-month expiry.
17 lines
688 B
YAML
17 lines
688 B
YAML
# Safety vulnerability ignore policy
|
|
# https://docs.safetycli.com/safety-docs/configuration/policy-file
|
|
|
|
version: "3.0"
|
|
|
|
# Security policy for known vulnerabilities
|
|
security:
|
|
# Ignore specific vulnerabilities with justification
|
|
ignore-vulnerabilities:
|
|
# CVE-2024-46946: LLMSymbolicMathChain RCE via sympy.sympify eval()
|
|
# Justification: We only use SemanticChunker from langchain-experimental,
|
|
# not the vulnerable LLMSymbolicMathChain component.
|
|
# The SemanticChunker is safe and doesn't use eval().
|
|
- vulnerability-id: "73280"
|
|
reason: "We only use SemanticChunker, not the vulnerable LLMSymbolicMathChain"
|
|
expires: "2025-06-20" # Review in 6 months
|