CVE-2024-27444

2024-02-2616:28:00

Google

osv.dev

langchain

langchain experimental

cve-2024-27444

bypass

arbitrary code

python

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.6%

JSON

langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by pal_chain/base.py.

CPENameOperatorVersion
langchaineq0.0.105
langchaineq0.0.137
langchaineq0.0.159
langchaineq0.0.169
langchaineq0.0.300
langchaineq0.1.5
langchaineq0.0.164
langchaineq0.0.147
langchaineq0.0.346
langchaineq0.0.354

Name	Operator	Version
langchain	eq	0.0.105
langchain	eq	0.0.137
langchain	eq	0.0.159
langchain	eq	0.0.169
langchain	eq	0.0.300
langchain	eq	0.1.5
langchain	eq	0.0.164
langchain	eq	0.0.147
langchain	eq	0.0.346
langchain	eq	0.0.354