CVE-2023-36258

Advisory

Affected versions of Langchain allow an attacker to execute arbitrary code via the PALChain in the python exec method. The PALChain class requires unique security considerations so it was moved langchain-experimental package and removed from langchain on version 0.0.247. The issue was attempted to be resolved several times in langchain-experimental but the fixes were found incomplete. See CVE-2023-44467, CVE-2024-27444, and CVE-2024-38459.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

An issue in langchain v.0.0.199 allows an attacker to execute arbitrary code via the PALChain in the python exec method. See CVE-2023-36258.


MISC:https://github.com/hwchase17/langchain/issues/5872: https://github.com/hwchase17/langchain/issues/5872

Resources

• https://github.com/langchain-ai/langchain/issues/5872#issuecomment-1697785619
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36258
• https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e
• https://github.com/langchain-ai/langchain/pull/8425