Arbitrary Code Execution Affecting langchain package, versions [,0.0.225)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.18% (56th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-LANGCHAIN-5710354
- published 19 Jun 2023
- disclosed 14 Jun 2023
- credit Unknown
Introduced: 14 Jun 2023
CVE-2023-34540 Open this link in a new tabHow to fix?
Upgrade langchain to version 0.0.225 or higher.
Overview
langchain is a Building applications with LLMs through composability
Affected versions of this package are vulnerable to Arbitrary Code Execution with the jira.run() command, which allows functions like exec() to be called with the other argument.
PoC
jira = JiraAPIWrapper()
output = jira.run('other',"exec(\"import os;print(os.popen('id').read())\")")
References
CVSS Scores
version 3.1