要点
- CVE-2023-36095 是影响 langchain, langchain (langchain) 的严重 (CVSS 9.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.2%，高于 67.4% 的漏洞。
- 修复：升级到 0.0.236 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| langchain PyPI | < 0.0.236
| 0.0.236
|
| langchain | = 0.0.194
| No fix yet |
Description
An issue in Harrison Chase langchain allows an attacker to execute arbitrary code via the PALChain,from_math_prompt(llm).run in the python exec method.
NVD description
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free