| Package | Affected versions | Patched versions |
|---|---|---|
| langchain-experimental | < 0.0.52 | 0.0.52 |
| langchain-experimental | < 0.1.8 | 0.1.8 |
langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free