LangChain Experimental Eval Injection vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-46946 · ADVISORY
• docs.sympy.org/latest/modules/codegen.html · WEB
• gist.github.com/12end/68c0c58d2564ef4141bccd4651480820 · WEB
• langchain-ai/langchain · PACKAGE
• langchain-ai/langchain release langchain-experimental==0.3.0 · WEB
• pypa/advisory-database · WEB
• pypi.org/project/langchain-experimental · WEB
• cwe.mitre.org/data/definitions/95.html · Not Applicable
• GitHub Advisory GHSA-p2qj-r53j-h3xj · ADVISORY

langchain-experimental のその他の脆弱性

• CVE-2024-21513高 8.5Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving valu…
• CVE-2024-38459高 7.8langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; th…
• CVE-2024-27444緊急 9.8langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execut…
• CVE-2023-44467緊急 9.8langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and exec…