All vulnerabilities
CVE-2023-1712GHSA-w7qg-j435-78qwPYSEC-2026-337

farm-haystack: Use of hard-coded, security-relevant constants in deepset-ai/haystack

deepset-ai farm-haystackpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 11 Feb 2025. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.85%Chance of exploitation activity in the next 30 days, higher than 57% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in0.1.30Fixed versionCVE List
Published30 Mar 2023Updated 27 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1.

Text from CVE List

Affected versions 53

  • farm-haystack, pip<= 1.15.0GitHub
  • deepset-ai/haystackaffected: unspecified before 0.1.30CVE List
  • farm-haystack, PyPIfrom first release, through 1.15.0OSV
  • farm-haystack, PyPI0.1.0.post2OSV
  • farm-haystack, PyPI0.10.0OSV
  • farm-haystack, PyPI0.2.0.post1OSV
  • farm-haystack, PyPI0.2.1OSV
  • farm-haystack, PyPI0.3.0OSV
  • farm-haystack, PyPI0.4.0OSV
  • farm-haystack, PyPI0.5.0OSV
  • farm-haystack, PyPI0.6.0OSV
  • farm-haystack, PyPI0.7.0OSV
  • farm-haystack, PyPI0.8.0OSV
  • farm-haystack, PyPI0.9.0OSV
  • farm-haystack, PyPI1.0.0OSV
  • farm-haystack, PyPI1.1.0OSV
  • farm-haystack, PyPI1.10.0OSV
  • farm-haystack, PyPI1.10.0rc1OSV
  • farm-haystack, PyPI1.11.0OSV
  • farm-haystack, PyPI1.11.0rc0OSV
  • farm-haystack, PyPI1.11.1OSV
  • farm-haystack, PyPI1.11.1rc1OSV
  • farm-haystack, PyPI1.12.0OSV
  • farm-haystack, PyPI1.12.0rc1OSV
  • farm-haystack, PyPI1.12.0rc2OSV
  • farm-haystack, PyPI1.12.1OSV
  • farm-haystack, PyPI1.12.2OSV
  • farm-haystack, PyPI1.12.2rc1OSV
  • farm-haystack, PyPI1.13.0OSV
  • farm-haystack, PyPI1.13.0rc1OSV
  • farm-haystack, PyPI1.13.0rc2OSV
  • farm-haystack, PyPI1.13.1OSV
  • farm-haystack, PyPI1.13.1rc1OSV
  • farm-haystack, PyPI1.13.2OSV
  • farm-haystack, PyPI1.13.2rc0OSV
  • farm-haystack, PyPI1.14.0OSV
  • farm-haystack, PyPI1.14.0rc1OSV
  • farm-haystack, PyPI1.14.0rc2OSV
  • farm-haystack, PyPI1.15.0OSV
  • farm-haystack, PyPI1.15.0rc1OSV
  • farm-haystack, PyPI1.15.0rc2OSV
  • farm-haystack, PyPI1.15.0rc3OSV
  • farm-haystack, PyPI1.15.0rc4OSV
  • farm-haystack, PyPI1.15.0rc5OSV
  • farm-haystack, PyPI1.2.0OSV
  • farm-haystack, PyPI1.3.0OSV
  • farm-haystack, PyPI1.4.0OSV
  • farm-haystack, PyPI1.5.0OSV
  • farm-haystack, PyPI1.6.0OSV
  • farm-haystack, PyPI1.7.0OSV
  • farm-haystack, PyPI1.7.1OSV
  • farm-haystack, PyPI1.8.0OSV
  • farm-haystack, PyPI1.9.0OSV

References 7