Arbitrary Code Execution Affecting langchain package, versions [,0.0.307)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
1.16% (86th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-LANGCHAIN-5880430
- published 4 Sep 2023
- disclosed 1 Sep 2023
- credit Unknown
Introduced: 1 Sep 2023
CVE-2023-39631 Open this link in a new tabHow to fix?
Upgrade langchain to version 0.0.307 or higher.
Overview
langchain is a Building applications with LLMs through composability
Affected versions of this package are vulnerable to Arbitrary Code Execution due to use of the evaluate() function in the numexpr library. An attacker can send arbitrary commands to the underlying eval() function by incorporating them in a malicious prompt.
References
CVSS Scores
version 3.1