CVE-2023-36258: Langchain arbitrary code execution vulnerability

# CVE-2023-36258: Langchain arbitrary code execution vulnerability

https://gcdradar.vercel.app/incidents/cve-2023-36258-langchain-arbitrary-code-execution-vulnerabil · AIR-2023-0051 · closed 2023-07-03

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2023-07-03
- AI role: Attack on AI
- Products: Langchain
- CVE ids: CVE-2023-36258
- CVSS: 9.8

## Summary

An issue in Langchain permits arbitrary code execution through the PALChain component via python exec. A patch has been released to address the flaw.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-07-03: CVE-2023-36258: An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or… (https://nvd.nist.gov/vuln/detail/CVE-2023-36258)
- 2023-07-03: CVE-2023-36258: langchain arbitrary code execution vulnerability (https://github.com/advisories/GHSA-2qmj-7962-cjq8)

## Sources

- 2023-07-03 GitHub Advisory Database: CVE-2023-36258: langchain arbitrary code execution vulnerability https://github.com/advisories/GHSA-2qmj-7962-cjq8
- 2023-07-03 NVD: CVE-2023-36258: An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or… https://nvd.nist.gov/vuln/detail/CVE-2023-36258

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.