GHSA-v8vj-cv27-hjv8

LangChain Experimental vulnerable to arbitrary code execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-27444

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	langchain-experimental	< 0.0.52	0.0.52

Details

As written in the advisory (Markdown source, shown as plain text).

langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the `__import__`, `__subclasses__`, `__builtins__`, `__globals__`, `__getattribute__`, `__bases__`, `__mro__`, or `__base__` attribute in Python code. These are not prohibited by `pal_chain/base.py`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-27444 advisory
https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7 web
https://github.com/langchain-ai/langchain package
https://github.com/pypa/advisory-database/tree/main/vulns/langchain-experimental/PYSEC-2026-375.yaml web
https://pypi.org/project/langchain-experimental web