CVE-2023-44467

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

langchain_experimental 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via the PALChain in the python exec method. See CVE-2023-44467.


MISC:https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483: https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483

Resources

• https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44467
• https://inspector.pypi.io/project/langchain-experimental/0.0.24/packages/9b/3f/73dab2ac5aaea08f2eff5478c59b12a7e298a108c5b7d5dc1c4547eacb80/langchain_experimental-0.0.24.tar.gz/langchain_experimental-0.0.24/langchain_experimental/pal_chain/base.py#line.23