Read the docs
TI-2023-01606 Aliases CVE-2023-1712GHSA-w7qg-j435-78qw

Use of Hard-coded, Security-relevant Constants in deepset-ai/haystack

Priority HIGH 81CWE-547Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0085 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed deepset-ai/haystack (deepset-ai): 0.1.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
deepset-aideepset-ai/haystackbefore 0.1.300.1.30Patch availableCNA
—farm-haystack (PyPI)up to 1.15.0—No fix listedGHSA-w7qg-j435-78qw
  • deepset-ai/haystack Vendordeepset-ai Affected before 0.1.30 Fixed in 0.1.30 Patch available CNA
  • farm-haystack (PyPI) Vendor— Affected up to 1.15.0 Fixed in — No fix listed GHSA-w7qg-j435-78qw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deepset:haystack:*:*:*:*:*:*:*:*before 2023-03-29VulnerableDeepset
  • cpe:2.3:a:deepset:haystack:*:*:*:*:*:*:*:* Versions before 2023-03-29 Vulnerable ·Deepset

Remediation

  • Fix · CNA deepset-ai/haystack (deepset-ai) Fixed in 0.1.30

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1712
  2. 2026-10-03 Alias added: GHSA-w7qg-j435-78qw

References

Exploit 1

Patch 1

Advisory 1

Other 4

  • TI-2026-83742 Path traversal in deepset-ai farm tokenizer loader CVSS 4.0MEDIUM 5.3
  • TI-2026-83743 Path traversal in deepset-ai farm Model Package Loader CVSS 4.0LOW 2.4
  • TI-2024-27972 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences