CVE-2023-38896

CriticalCVSS 9.8

Published: 15/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.52%

71th percentile - higher than 71% of all known CVEs

Summary

Versions of Harrison Chase langchain up to 0.0.194 contain a vulnerability that allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.

Risk Assessment

An attacker could exploit this vulnerability to remotely execute unauthorized code, potentially leading to serious security implications.

Recommendation

It is recommended to upgrade to the latest version of Harrison Chase langchain to mitigate this vulnerability.

Original NVD description (English source)

An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.