CVE-2023-34541: Langchain vulnerable to arbitrary code execution

# CVE-2023-34541: Langchain vulnerable to arbitrary code execution

https://gcdradar.vercel.app/incidents/cve-2023-34541-langchain-vulnerable-to-arbitrary-code-execut · AIR-2023-0050 · closed 2023-06-20

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2023-06-20
- AI role: Attack on AI
- Products: Langchain
- CVE ids: CVE-2023-34541
- CVSS: 9.8

## Summary

Langchain is affected by an arbitrary code execution vulnerability in the load_prompt function. Users are advised to upgrade to the patched version.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-06-20: CVE-2023-34541: Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt. (https://nvd.nist.gov/vuln/detail/CVE-2023-34541)
- 2023-06-20: CVE-2023-34541: Langchain vulnerable to arbitrary code execution (https://github.com/advisories/GHSA-6643-h7h5-x9wh)

## Sources

- 2023-06-20 GitHub Advisory Database: CVE-2023-34541: Langchain vulnerable to arbitrary code execution https://github.com/advisories/GHSA-6643-h7h5-x9wh
- 2023-06-20 NVD: CVE-2023-34541: Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt. https://nvd.nist.gov/vuln/detail/CVE-2023-34541

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.