drama-agent (>=0.1.1, <=0.1.4), kube-copilot (>=0.1.21, <=0.1.22) +2 more potentially affected by CVE-2024-21513 via langchain-experimental (>=0.0.8, <=0.0.14)

langchain-experimental PYPI version =0.0.8, =0.1.1, =0.1.21, =0.0.13, =0.0.18 - myevery 0.0.11 Source cves: CVE-2024-21513 Source advisory: OSV:GHSA-CGCG-P68Q-3W7V...

GHSA-CGCG-P68Q-3W7V langchain-experimental vulnerable to Arbitrary Code Execution

Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if the...

drama-agent (>=0.1.1, <=0.1.4), kube-copilot (>=0.1.21, <=0.1.22) +2 more potentially affected by CVE-2024-21513 via langchain-experimental (>=0.0.8, <=0.0.14)

langchain-experimental PYPI version =0.0.8, =0.1.1, =0.1.21, =0.0.13, =0.0.18 - myevery 0.0.11 Source cves: CVE-2024-21513 Source advisory: OSV:PYSEC-2024-62...

ceylon (>=0.2.0b1, <=0.20.0), gpt-all-star (>=0.0.52, <=0.0.54) +2 more potentially affected by CVE-2024-21513 via langchain-experimental (0.0.64)

langchain-experimental PYPI version 0.0.64 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-experimental and may be impacted: - ceylon =0.2.0b1, =0.0.52, =0.1.5, =2.4.48, =2.5.19 Source cves: CVE-2024-21513 Source advisory: OSV:PYSEC-2024-62...

archive-retriever (0.1.0), crewai (>=0.61.0, <=0.70.1) +14 more potentially affected by CVE-2024-21513 via langchain-experimental (0.0.65)

langchain-experimental PYPI version 0.0.65 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-experimental and may be impacted: - archive-retriever 0.1.0 - crewai =0.61.0, =0.1.3, =0.1.114, =0.1.120a1, =0.1.120, =0.0.48, =0.0.96.dev6, =0.3.10a5,...

PYSEC-2024-62

Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if the...

PYSEC-2024-62

Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if the...

CVE-2024-21513

langchain-experimental versions 0.0.15 and earlier than 0.0.21 are vulnerable to Arbitrary Code Execution via eval() on database-retrieved values when using VectorSQLDatabaseChain. The vulnerability requires an attacker to influence the input prompt and can enable Python code execution on the ser...

drama-agent (>=0.1.1, <=0.1.4), kube-copilot (>=0.1.21, <=0.1.22) +2 more potentially affected by CVE-2024-21513 via langchain-experimental (>=0.0.8, <=0.0.14)

langchain-experimental PYPI version =0.0.8, =0.1.1, =0.1.21, =0.0.13, =0.0.18 - myevery 0.0.11 Source cves: CVE-2024-21513 Source advisory: MEND:CVE-2024-21513...

CVE-2024-21513

Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if the...

LangChain Security Breach

LangChain is an application built using LLM through composability by LangChain, Inc. in the United States. A security vulnerability exists in LangChain versions 0.0.15 through 0.0.21 and earlier, which stems from vulnerability to an arbitrary code execution attack that can be exploited by an...

CVE-2024-21513: Improper Control of Generation of Code

Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if the...

PT-2024-18926 · Unknown · Langchain Experimental +1

Name of the Vulnerable Software and Affected Versions: langchain-experimental versions 0.0.15 through 0.0.21 Description: The issue allows for Arbitrary Code Execution when retrieving values from the database. An attacker can exploit this by controlling the input prompt and executing arbitrary...

Arbitrary Code Execution

Overview langchain-experimental is a package that holds experimental LangChain code, intended for research and experimental uses. Affected versions of this package are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all...

apsbot (>=0.2.0, <=0.3.1), askagent (>=0.1.0, <=0.1.1) +37 more potentially affected by CVE-2024-38459 via langchain-experimental (>=0.0.8, <=0.0.60)

langchain-experimental PYPI version =0.0.8, =0.2.0, =0.1.0, =0.0.3, =0.1.1, =0.0.1a1, =0.1.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.21, =0.1.27 and more Source cves: CVE-2024-38459 Source advisory: OSV:GHSA-WMVM-9VQV-5QPP...

langchain_experimental Code Execution via Python REPL access

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

apsbot (>=0.2.0, <=0.3.1), askagent (>=0.1.0, <=0.1.1) +37 more potentially affected by CVE-2024-38459 via langchain-experimental (>=0.0.8, <=0.0.60)

langchain-experimental PYPI version =0.0.8, =0.2.0, =0.1.0, =0.0.3, =0.1.1, =0.0.1a1, =0.1.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.21, =0.1.27 and more Source cves: CVE-2024-38459 Source advisory: GHSA-WMVM-9VQV-5QPP...

GHSA-WMVM-9VQV-5QPP langchain_experimental Code Execution via Python REPL access

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

CVE-2024-38459

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

PYSEC-2024-53

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...