LangChain vulnerable to code injection

CRITICAL 9.8CVE-2023-29374 · GHSA-fprp-p869-w6q2 · PYSEC-2023-18 · Published 05/04/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
langchain PyPI	`≤ 0.0.131< 0.0.132`	`0.0.132`
langchain langchain	`≤ 0.0.131`	No fix yet

Description

In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec() method.

NVD description

In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.

References

nvd.nist.gov/vuln/detail/CVE-2023-29374 · ADVISORY
hwchase17/langchain · WEB
hwchase17/langchain · WEB
hwchase17/langchain#1119 · WEB
langchain-ai/langchain · PACKAGE
pypa/advisory-database · WEB
twitter.com/rharang/status/1641899743608463365/photo/1 · WEB
GitHub Advisory GHSA-fprp-p869-w6q2 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free