Fluid Attacks Database

Description

LangChain vulnerable to arbitrary code execution An issue in langchain langchain-ai before version 0.0.325 allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	langchain	>=0 <0.0.325	0.0.325

Aliases

1. CVE-2023-396592. NVD-2023-396593. OSV-2023-396594. GCVE-2023-39659

References

1. https://github.com/langchain-ai/langchain/issues/77002. https://github.com/langchain-ai/langchain/pull/124273. https://github.com/langchain-ai/langchain/pull/56404. https://github.com/langchain-ai/langchain/commit/cadfce295f8a33828fc635c2e5ea28b883e5c9925. https://github.com/langchain-ai/langchain/releases/tag/v0.0.3256. https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-147.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.