logo

Database

Lack of data validation In langchain

Description

LangChain vulnerable to arbitrary code execution An issue in Harrison Chase langchain before version 0.0.236 allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-388962. NVD-2023-388963. OSV-2023-388964. GCVE-2023-38896

References

1. https://github.com/hwchase17/langchain/issues/58722. https://github.com/hwchase17/langchain/pull/60033. https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea1374. https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e5. https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-146.yaml6. https://twitter.com/llm_sec/status/1668711587287375876

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.