GoogleOSV:GHSA-57FC-8Q82-GFP3langchain vulnerable to arbitrary code execution
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
69.1%
An issue in langchain allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.
References
github.com/langchain-ai/langchain
github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e
github.com/langchain-ai/langchain/issues/5872
github.com/langchain-ai/langchain/pull/6003
github.com/langchain-ai/langchain/pull/8425
github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-109.yaml
nvd.nist.gov/vuln/detail/CVE-2023-36188
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
69.1%