CVE-2023-36095: langchain Code Injection vulnerability

# CVE-2023-36095: langchain Code Injection vulnerability

https://gcdradar.vercel.app/incidents/cve-2023-36095-langchain-code-injection-vulnerability · AIR-2023-0056 · closed 2023-08-05

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2023-08-05
- AI role: Attack on AI
- Products: langchain
- CVE ids: CVE-2023-36095
- CVSS: 9.8

## Summary

A code injection vulnerability in LangChain allows attackers to execute arbitrary code via PALChain components. The issue affects versions prior to 0.0.236.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-08-05: CVE-2023-36095: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the… (https://nvd.nist.gov/vuln/detail/CVE-2023-36095)
- 2023-08-05: CVE-2023-36095: langchain Code Injection vulnerability (https://github.com/advisories/GHSA-gwqq-6vq7-5j86)

## Sources

- 2023-08-05 GitHub Advisory Database: CVE-2023-36095: langchain Code Injection vulnerability https://github.com/advisories/GHSA-gwqq-6vq7-5j86
- 2023-08-05 NVD: CVE-2023-36095: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the… https://nvd.nist.gov/vuln/detail/CVE-2023-36095

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.