PT-2024-21902 · Langchain+1 · Langchain+1

Published 2024-02-25 · Updated 2025-07-14 · CVE-2024-27444

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 0.1.8 langchain experimental versions prior to 0.0.52

Description The issue allows an attacker to bypass a previous fix and execute arbitrary code via certain attributes in Python code, including import, subclasses, builtins, globals, getattribute, bases, mro, or base. These attributes are not prohibited by pal chain/base.py.

Recommendations For LangChain versions prior to 0.1.8, update to version 0.1.8 or later. For langchain experimental versions prior to 0.0.52, update to version 0.0.52 or later. As a temporary workaround, consider restricting the use of the import, subclasses, builtins, globals, getattribute, bases, mro, or base attributes in Python code until a patch is applied.

Fix

Weakness Enumeration

CWE-749

Related Identifiers

CVE-2024-27444

GHSA-V8VJ-CV27-HJV8

Affected Products

Langchain

Langchain Experimental

References · 9

• https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27444 · Security Note
• https://osv.dev/vulnerability/GHSA-v8vj-cv27-hjv8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27444 · Vendor Advisory
• https://github.com/langchain-ai/langchain · Note
• https://t.me/cvenotify/128911 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1762171764488999002 · Twitter Post
• https://t.me/cvenotify/83425 · Telegram Post
• https://twitter.com/CVEnew/status/1761977531526201565 · Twitter Post