PT-2023-26673 · Harrison Chase · Langchain

Llm Security · Published 2023-08-15 · Updated 2023-08-22 · CVE-2023-38896

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Harrison Chase langchain versions 0.0.194 and before Harrison Chase langchain versions prior to 0.0.236

Description An issue in Harrison Chase langchain allows a remote attacker to execute arbitrary code via the from math prompt and from colored object prompt functions.

Recommendations For versions 0.0.194 and before, update to version 0.0.236 or later to resolve the issue. As a temporary workaround, consider disabling the from math prompt and from colored object prompt functions until a patch is available.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2023-38896

GHSA-92J5-3459-QGP4

PYSEC-2023-146

Affected Products

Langchain

References · 14

• 🔥 https://github.com/hwchase17/langchain/issues/5872 · Exploit
• https://github.com/hwchase17/langchain/pull/6003 · Patch
• https://osv.dev/vulnerability/GHSA-92j5-3459-qgp4 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38896 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38896 · Vendor Advisory
• https://github.com/langchain-ai/langchain · Note
• https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137 · Note
• https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-146.yaml · Note
• https://twitter.com/VulmonFeeds/status/1691522475425673216 · Twitter Post
• https://t.me/cibsecurity/68554 · Telegram Post
• https://twitter.com/CVEnew/status/1691493236416688148 · Twitter Post
• https://twitter.com/llm_sec/status/1668711587287375876 · Note