Advisoriesby IbisLangChainGHSA-v8vj-cv27-hjv8
LangChain Experimental vulnerable to arbitrary code execution
Fix: upgrade to 0.0.52 or later
langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| langchain-experimental PyPI | < 0.0.52 | 0.0.52 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-749
- Also known as
- CVE-2024-27444, PYSEC-2026-375
More LangChain advisories
All LangChain
Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetrieverCVE-2024-3095fixed in 0.2.9langchain vulnerable to path traversalCVE-2024-3571fixed in 0.0.353LangChain's XMLOutputParser vulnerable to XML Entity ExpansionCVE-2024-1455fixed in 0.1.35LangChain directory traversal vulnerabilityCVE-2024-28088fixed in 0.0.339 +1LangChain: server-side request forgeryCVE-2024-2057no fix yetlangchain Server-Side Request Forgery vulnerabilityCVE-2024-0243fixed in 0.1.0