Security Bulletin: Astronomer with IBM is vulnerable to arbitrary code execution due to the LangChain package (CVE-2023-39659).

Summary LangChain is used by Astronomer with IBM as part of LLM processing. Vulnerability Details CVEID:CVE-2023-39659 DESCRIPTION: LangChain could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the PythonAstREPLTool.ru...

agent-actors (=0.1.0), agent-lab-sdk (>=0.1.7 <=0.1.16) +279 more potentially affected by CVE-2023-39659 via langchain (>=0.0.100 <=0.0.323)

langchain PYPI version =0.0.100, =0.1.7, =0.2.1, =0.1.0, =0.1.5, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.8, =0.0.5, =0.0.14, =0.0.18 - athina =0.1.0 and more Source cves: CVE-2023-39659 Source advisory: OSV:GHSA-PRGP-W7VF-CH62...

agent-actors (=0.1.0), agent-reader (>=0.2.1 <=0.2.2) +156 more potentially affected by CVE-2023-39659 via langchain (>=0.0.100 <=0.0.232)

langchain PYPI version =0.0.100, =0.2.1, =0.1.0, =0.1.5, =0.0.1, =0.0.1, =0.0.1, =0.0.5, =0.0.14, =0.1.9, =0.0.33, =0.2.0, =0.1.3, =0.1.1, =0.1.18 and more Source cves: CVE-2023-39659 Source advisory: OSV:PYSEC-2023-147...

CVE-2023-39659

LangChain is affected by an arbitrary code execution vulnerability in the PythonAstREPLTool._run path, exploitable in LangChain-AI releases before a fixed version. Affected: LangChain before 0.0.325 (per OSV/GHSA) and NVD notes v0.0.232 and earlier. Root cause: improper neutralization of user-sup...

CVE-2023-39659

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...