logo

Database

Server side template injection In langchain

Description

Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.

Patches: Released in v.0.0.308. numexpr dependency is optional for langchain.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-396312. NVD-2023-396313. OSV-2023-396314. GCVE-2023-39631

References

1. https://github.com/langchain-ai/langchain/issues/83632. https://github.com/pydata/numexpr/issues/4423. https://github.com/langchain-ai/langchain/pull/113024. https://github.com/pydata/numexpr/commit/4b2d89cf14e75030d27629925b9998e1e91d23c75. https://github.com/langchain-ai/langchain/releases/tag/v0.0.3086. https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-162.yaml7. https://github.com/pypa/advisory-database/tree/main/vulns/numexpr/PYSEC-2023-163.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.