Fluid Attacks Database

Description

langchain_experimental Code Execution via Python REPL access langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
pypi	langchain-experimental	>=0 <0.0.61	0.0.61

Aliases

1. CVE-2024-384592. NVD-2024-384593. OSV-2024-384594. GCVE-2024-38459

References

1. https://github.com/langchain-ai/langchain/pull/228602. https://github.com/langchain-ai/langchain/commit/ce0b0f22a175139df8f41cdcfb4d2af4111120093. https://github.com/langchain-ai/langchain/compare/langchain-experimental==0.0.60...langchain-experimental==0.0.614. https://github.com/pypa/advisory-database/tree/main/vulns/langchain-experimental/PYSEC-2024-53.yaml