Security Bulletin: Astronomer with IBM is vulnerable to arbitrary code execution due to the LangChain package (CVE-2023-39659).

Summary LangChain is used by Astronomer with IBM as part of LLM processing. Vulnerability Details CVEID:CVE-2023-39659 DESCRIPTION: LangChain could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the PythonAstREPLTool.ru...

CVE-2023-39659

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool.run component...

CVE-2023-39659

LangChain is affected by an arbitrary code execution vulnerability in the PythonAstREPLTool._run path, exploitable in LangChain-AI releases before a fixed version. Affected: LangChain before 0.0.325 (per OSV/GHSA) and NVD notes v0.0.232 and earlier. Root cause: improper neutralization of user-sup...