CVE-2023-39631

CriticalCVSS 9.8

Published: 01/09/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.32%

67th percentile - higher than 67% of all known CVEs

Summary

Version 0.0.245 of the LanChain-ai Langchain library contains a vulnerability that allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.

Risk Assessment

An attacker could exploit this vulnerability to run unauthorized code, potentially leading to serious security implications for the system.

Recommendation

It is recommended to update to the latest version of the LanChain-ai Langchain library to mitigate this vulnerability.

Original NVD description (English source)

An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.