~ / search / GHSA-fprp-p869-w6q2

GHSA-fprp-p869-w6q2

LangChain vulnerable to code injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-29374

Packages

EcosystemPackageAffectedFixed in
PyPI langchain <= 0.0.131 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In LangChain through 0.0.131, the `LLMMathChain` chain allows prompt injection attacks that can execute arbitrary code via the Python `exec()` method.

References

External links from the advisory. They lead to third-party sites.