{"id":"GHSA-w7qg-j435-78qw","aliases":["CVE-2023-1712","PYSEC-2026-337"],"title":"Use of hard-coded, security-relevant constants in deepset-ai/haystack","description":"Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1.","severity":"critical","score":9.8,"published":"2023-03-30T12:30:15.000Z","modified":"2026-10-27T17:00:05.122Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"farm-haystack","ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.15.0"}],"type":"ECOSYSTEM"}],"versions":["0.1.0.post2","0.10.0","0.2.0.post1","0.2.1","0.3.0","0.4.0","0.5.0","0.6.0","0.7.0","0.8.0","0.9.0","1.0.0","1.1.0","1.10.0","1.10.0rc1","1.11.0","1.11.0rc0","1.11.1","1.11.1rc1","1.12.0","1.12.0rc1","1.12.0rc2","1.12.1","1.12.2","1.12.2rc1","1.13.0","1.13.0rc1","1.13.0rc2","1.13.1","1.13.1rc1","1.13.2","1.13.2rc0","1.14.0","1.14.0rc1","1.14.0rc2","1.15.0","1.15.0rc1","1.15.0rc2","1.15.0rc3","1.15.0rc4","1.15.0rc5","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","1.9.0rc1","1.9.0rc2","1.9.0rc3","1.9.1","1.9.1rc1"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2023-1712","https://github.com/deepset-ai/haystack/pull/4535","https://github.com/deepset-ai/haystack/commit/5fc84904f198de661d5b933fde756aa922bf09f1","https://github.com/deepset-ai/haystack","https://github.com/pypa/advisory-database/tree/main/vulns/farm-haystack/PYSEC-2026-337.yaml","https://huntr.dev/bounties/9a6b1fb4-ec9b-4cfa-af1e-9ce304924829","https://pypi.org/project/farm-haystack"],"sources":[{"name":"OSV","id":"GHSA-w7qg-j435-78qw","modified":"2026-10-27T17:00:05.122724921Z","url":"https://osv.dev/vulnerability/GHSA-w7qg-j435-78qw"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}