PT-2023-29247 · Unknown · Langchain Experimental
Published
2023-10-09
·
Updated
2025-07-14
·
CVE-2023-44467
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
langchain experimental versions prior to 0.0.306
Description
The issue allows an attacker to bypass a previous fix and execute arbitrary code via
import in Python code. This is possible because the pal chain/base.py does not prohibit the use of import. The vulnerability can also be exploited through the PALChain in the python exec method.Recommendations
For versions prior to 0.0.306, update to version 0.0.306 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
import function and the PALChain in the python exec method until a patch is applied. Avoid using the exec method with untrusted input to minimize the risk of exploitation.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Langchain Experimental