CVE-2023-36095
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
A vulnerability in LangChain version 0.0.194 allows remote code execution via the from_math_prompt and from_colored_object_prompt functions in the PALChain class. An attacker can inject malicious Python code through the eval mechanism.
Risk Assessment
The risk for the organization includes full system compromise, data theft, or disruption of applications using the vulnerable LangChain version.
Recommendation
Immediately upgrade LangChain to a version newer than 0.0.194 and restrict access to PALChain functions in production environments.
Original NVD description (English source)
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.