PT-2023-27040 · Langchain+2 · Langchain+2

Corgeman · Published 2023-01-09 · Updated 2026-05-05 · CVE-2023-39631

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LangChain versions 0.0.245 through 0.0.307

Description The issue is related to incorrect code generation control in the numexpr library of the LangChain framework, allowing a remote attacker to execute arbitrary code via the evaluate function. This can lead to exploitation by a remote attacker.

Recommendations For versions 0.0.245 through 0.0.307, update to version 0.0.308 or later, which includes a patch for the numexpr dependency issue. As a temporary workaround, consider disabling the evaluate function in the numexpr library until a patch is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-01410

CVE-2023-39631

GHSA-F73W-4M7G-CH9X

PYSEC-2023-162

PYSEC-2023-163

Affected Products

Langchain

Red Os

Numexpr

References · 20

• 🔥 https://github.com/langchain-ai/langchain/issues/8363 · Exploit
• 🔥 https://github.com/pydata/numexpr/issues/442 · Exploit
• https://osv.dev/vulnerability/GHSA-f73w-4m7g-ch9x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39631 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-162 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-163 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-39631 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39631 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01410 · Security Note
• https://github.com/langchain-ai/langchain · Note
• https://github.com/langchain-ai/langchain/pull/11302 · Note
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.308 · Note
• https://github.com/pydata/numexpr/commit/4b2d89cf14e75030d27629925b9998e1e91d23c7 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-162.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/numexpr/PYSEC-2023-163.yaml · Note