GHSA-2qmj-7962-cjq8
langchain arbitrary code execution vulnerability
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
An issue in langchain allows an attacker to execute arbitrary code via the PALChain in the python exec method.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-36258
- https://github.com/langchain-ai/langchain/issues/5872
- https://github.com/langchain-ai/langchain/issues/5872#issuecomment-1697785619
- https://github.com/langchain-ai/langchain/pull/6003
- https://github.com/langchain-ai/langchain/pull/7870
- https://github.com/langchain-ai/langchain/pull/8425
- https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137
- https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e
- https://github.com/langchain-ai/langchain/commit/fab24457bcf8ede882abd11419769c92bc4e7751
- https://github.com/hwchase17/langchain
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-98.yaml