CVE-2023-36258

CriticalCVSS 9.8

Published: 03/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.98%

58th percentile - higher than 58% of all known CVEs

Summary

An issue in LangChain before version 0.0.236 allows an attacker to execute arbitrary code. The ability to use os.system, exec, or eval in Python code poses a significant risk.

Risk Assessment

Organizations may be exposed to remote code execution, potentially leading to data loss or system takeover.

Recommendation

It is recommended to update LangChain to version 0.0.236 or later to mitigate this vulnerability.

Original NVD description (English source)

An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.