CVE-2023-39659

LangChain is affected by an arbitrary code execution vulnerability in the PythonAstREPLTool._run path, exploitable in LangChain-AI releases before a fixed version. Affected: LangChain before 0.0.325 (per OSV/GHSA) and NVD notes v0.0.232 and earlier. Root cause: improper neutralization of user-sup...

CVE-2023-39659

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...

CVE-2023-38860

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter...

CVE-2023-39659: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...

The vulnerability of the framework for creating applications based on the combination of language models (LLMs) like LangChain arises from the lack of protective measures for SQL query structures. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the framework for creating applications based on the combination of language models LLMs like LangChain relates to the lack of measures taken to protect SQL query structures. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized...

Arbitrary Code Execution

langchain is vulnerable to Arbitrary Code Execution. The vulnerability exists in the frommathprompt function at langchain.chains.PALChain which allows an attacker to execute arbitrary codes through prompt injection...

langchain Code Injection vulnerability

An issue in Harrison Chase langchain allows an attacker to execute arbitrary code via the PALChain,frommathpromptllm.run in the python exec method...

GHSA-GWQQ-6VQ7-5J86 langchain Code Injection vulnerability

An issue in Harrison Chase langchain allows an attacker to execute arbitrary code via the PALChain,frommathpromptllm.run in the python exec method...

CVE-2023-36095

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

CVE-2023-36095

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

Design/Logic Flaw

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

PYSEC-2023-138

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

CVE-2023-36095

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

LangChain Code Injection Vulnerability

LangChain is used to build applications using LLM through composability. A code injection vulnerability exists in Harrison Chase langchain version v.0.0.194, which stems from an arbitrary code execution vulnerability in frommathpromptllm.run...

CVE-2023-36095: Improper Control of Generation of Code

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

CVE-2023-36095

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

CVE-2023-36095

LangChain v0.0.194 is affected by a code-injection vulnerability (CVE-2023-36095) via the PALChain, enabling an attacker to execute arbitrary Python code through exec calls in from_math_prompt and from_colored_object_prompt. Reported impacts include high severity with potential full compromise; C...

CVE-2023-36095

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

SQL Injection

langchain is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the call function in sqldatabase/base.py allows a malicious user to inject and execute arbitrary SQL queries on the target system via the SQLDatabaseChain component...

Remote Code Execution (RCE)

langchain is vulnerable to Remote Code Execution RCE. Lack of proper checking of supplied user input allows an attacker to execute arbitrary code on the system via the PALChain in the python exec method...