Advisoriesby IbisLangChainGHSA-fprp-p869-w6q2
LangChain vulnerable to code injection
No fix yet
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec() method.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| langchain PyPI | <= 0.0.131 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-74, CWE-94
- Also known as
- CVE-2023-29374, PYSEC-2023-18
- nvd.nist.gov/vuln/detail/CVE-2023-29374
- github.com/hwchase17/langchain/issues/1026
- github.com/hwchase17/langchain/issues/814
- github.com/hwchase17/langchain/pull/1119
- github.com/langchain-ai/langchain
- github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-18.yaml
- twitter.com/rharang/status/1641899743608463365/photo/1
More LangChain advisories
All LangChain
langchain Code Injection vulnerabilityCVE-2023-36095fixed in 0.0.236langchain SQL Injection vulnerabilityCVE-2023-36189fixed in 0.0.247langchain vulnerable to arbitrary code executionCVE-2023-36188fixed in 0.0.247langchain arbitrary code execution vulnerabilityCVE-2023-36258fixed in 0.0.247Langchain vulnerable to arbitrary code executionCVE-2023-34541fixed in 0.0.247Langchain OS Command Injection vulnerabilityCVE-2023-34540fixed in 0.0.225