GHSA-fprp-p869-w6q2CriticalCVSS 9.8
LangChain vulnerable to code injection
🔗 CVE IDs covered (1)
📋 Description
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec() method.
🎯 Affected products1
- pip/langchain:<= 0.0.131
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2023-29374
- https://github.com/hwchase17/langchain/issues/1026
- https://github.com/hwchase17/langchain/issues/814
- https://github.com/hwchase17/langchain/pull/1119
- https://twitter.com/rharang/status/1641899743608463365/photo/1
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-18.yaml
- https://github.com/advisories/GHSA-fprp-p869-w6q2