PT-2023-29247 · Unknown · Langchain Experimental
Publicado
2023-10-09
·
Atualizado
2025-07-14
·
CVE-2023-44467
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
langchain experimental versions prior to 0.0.306
Description
The issue allows an attacker to bypass a previous fix and execute arbitrary code via
import in Python code. This is possible because the pal chain/base.py does not prohibit the use of import. The vulnerability can also be exploited through the PALChain in the python exec method.Recommendations
For versions prior to 0.0.306, update to version 0.0.306 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
import function and the PALChain in the python exec method until a patch is applied. Avoid using the exec method with untrusted input to minimize the risk of exploitation.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Langchain Experimental