In short
- CVE-2023-36095 is a CRITICAL (CVSS 9.8) vulnerability affecting langchain, langchain (langchain).
- Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.4% of all vulnerabilities.
- Fix: update to 0.0.236 or later.
| Package | Affected versions | Patched versions |
|---|
| langchain PyPI | < 0.0.236
| 0.0.236
|
| langchain | = 0.0.194
| No fix yet |
Description
An issue in Harrison Chase langchain allows an attacker to execute arbitrary code via the PALChain,from_math_prompt(llm).run in the python exec method.
NVD description
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free