langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-44467 · ADVISORY
• langchain-ai/langchain#11233 · WEB
• langchain-ai/langchain commit 4c97a10 · WEB
• langchain-ai/langchain · PACKAGE
• pypa/advisory-database · WEB
• pypi.org/project/langchain-experimental/0.0.14 · WEB
• GitHub Advisory GHSA-gjjr-63x4-v8cq · WEB

Autres vulnérabilités de langchain-experimental

• CVE-2024-46946CRITIQUE 9.8langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sy…
• CVE-2024-21513ÉLEVÉE 8.5Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving valu…
• CVE-2024-38459ÉLEVÉE 7.8langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; th…
• CVE-2024-27444CRITIQUE 9.8langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execut…