CVE-2023-38896

An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the frommathprompt and fromcoloredobjectprompt functions...

CVE-2023-39659

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...

CVE-2023-38860

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter...

CVE-2023-38860

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter...

PYSEC-2023-145

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter...

PYSEC-2023-146

An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the frommathprompt and fromcoloredobjectprompt functions...

agent-actors (=0.1.0), agentverse (>=0.1.5 <=0.1.8.1) +106 more potentially affected by CVE-2023-38896 via langchain (>=0.0.100 <=0.0.194)

langchain PYPI version =0.0.100, =0.1.5, =0.0.1, =0.0.1, =0.0.5, =0.0.14, =0.2.0, =0.1.3, =0.1.1, =5.2.0, =0.1.1, =0.35.0, =0.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2023-38896 Source advisory: OSV:PYSEC-2023-146...

PYSEC-2023-147

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...

agent-actors (=0.1.0), agent-reader (>=0.2.1 <=0.2.2) +176 more potentially affected by CVE-2023-38860 via langchain (>=0.0.100 <=0.0.246)

langchain PYPI version =0.0.100, =0.2.1, =0.1.0, =0.1.5, =0.0.1, =0.0.1, =0.0.1, =0.0.5, =0.0.14, =0.1.9, =0.0.33, =0.1.0a0, =0.2.0, =0.1.3, =0.1.5 and more Source cves: CVE-2023-38860 Source advisory: OSV:PYSEC-2023-145...

Code injection

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter...

agent-actors (=0.1.0), agent-reader (>=0.2.1 <=0.2.2) +156 more potentially affected by CVE-2023-39659 via langchain (>=0.0.100 <=0.0.232)

langchain PYPI version =0.0.100, =0.2.1, =0.1.0, =0.1.5, =0.0.1, =0.0.1, =0.0.1, =0.0.5, =0.0.14, =0.1.9, =0.0.33, =0.2.0, =0.1.3, =0.1.1, =0.1.18 and more Source cves: CVE-2023-39659 Source advisory: OSV:PYSEC-2023-147...

PYSEC-2023-147

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...

PYSEC-2023-145

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter...

PYSEC-2023-146

An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the frommathprompt and fromcoloredobjectprompt functions...

CVE-2023-38860

The CVE-2023-38860 issue affects LangChain v0.0.231, where an attacker can trigger remote code execution via the prompt parameter due to insecure handling. Reported details across sources confirm a critical severity (CVSS v3.1: 9.8, NETWORK vector, no user interaction, high impact on confidential...

PT-2023-26673 · Harrison Chase · Langchain

Name of the Vulnerable Software and Affected Versions: Harrison Chase langchain versions 0.0.194 and before Harrison Chase langchain versions prior to 0.0.236 Description: An issue in Harrison Chase langchain allows a remote attacker to execute arbitrary code via the from math prompt and from...

CVE-2023-38860

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter...

CVE-2023-38896

An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the frommathprompt and fromcoloredobjectprompt functions...

CVE-2023-38896

CVE-2023-38896 affects Harrison Chase LangChain up to and including versions before 0.0.236 (per OSV and GHSA) and up to v0.0.194 and earlier (per NVD). It enables remote arbitrary code execution via from_math_prompt and from_colored_object_prompt due to improper neutralization of user input. Imp...

LangChain Injection Vulnerability

LangChain is used to build applications using LLM through composability. A security vulnerability exists in langchain version 0.0.194 and earlier versions, which results from arbitrary code execution via the frommathprompt and fromcoloredobjectprompt functions...