En resumen
- CVE-2023-36095 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a langchain, langchain (langchain).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 67.4% de las vulnerabilidades.
- Solución: actualizar a 0.0.236 o posterior.
| Package | Affected versions | Patched versions |
|---|
| langchain PyPI | < 0.0.236
| 0.0.236
|
| langchain | = 0.0.194
| No fix yet |
Description
An issue in Harrison Chase langchain allows an attacker to execute arbitrary code via the PALChain,from_math_prompt(llm).run in the python exec method.
NVD description
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free