CVE-2023-36095

Advisory

Langchain 0.0.236 includes a fix for an Arbitrary Code Execution vulnerability. In affected versions, the vulnerability allows an attacker to execute arbitrary code via the Python exec calls in the PALChain.
https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137
https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e

Affected package

Affected versions

Fixed versions

Vulnerability changelog

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the PALChain,from_math_prompt(llm).run in the python exec method. See CVE-2023-36095.


MISC:http://langchain.com: http://langchain.com
MISC:https://github.com/hwchase17/langchain: https://github.com/hwchase17/langchain
MISC:https://github.com/langchain-ai/langchain/issues/5872: https://github.com/langchain-ai/langchain/issues/5872

Resources

• http://langchain.com
• https://github.com/hwchase17/langchain
• https://github.com/langchain-ai/langchain/issues/5872
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36095