Lucene search

GoogleOSV:CVE-2023-44467

HistoryOct 09, 2023 - 8:15 p.m.

CVE-2023-44467

2023-10-0920:15:10

Google

osv.dev

langchain

vulnerability

code execution

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.8%

JSON

langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by pal_chain/base.py.

CPENameOperatorVersion
langchaineq0.0.105
langchaineq0.0.113
langchaineq0.0.137
langchaineq0.0.256
langchaineq0.0.278
langchaineq0.0.266
langchaineq0.0.159
langchaineq0.0.212
langchaineq0.0.169
langchaineq0.0.228

Name	Operator	Version
langchain	eq	0.0.105
langchain	eq	0.0.113
langchain	eq	0.0.137
langchain	eq	0.0.256
langchain	eq	0.0.278
langchain	eq	0.0.266
langchain	eq	0.0.159
langchain	eq	0.0.212
langchain	eq	0.0.169
langchain	eq	0.0.228

Rows per page:

1-10 of 2501

References

github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.8%

JSON

Related for OSV:CVE-2023-44467