CVE-2023-36281: LangChain arbitrary code execution vulnerability

# CVE-2023-36281: LangChain arbitrary code execution vulnerability

https://gcdradar.vercel.app/incidents/cve-2023-36281-langchain-arbitrary-code-execution-vulnerabil · AIR-2023-0061 · closed 2023-08-22

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2023-08-22
- AI role: Attack on AI
- Products: langchain
- CVE ids: CVE-2023-36281
- CVSS: 9.8

## Summary

A vulnerability in langchain enabled remote attackers to execute arbitrary code by passing a crafted JSON file to the load_prompt parameter. The issue was resolved in later software versions.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-08-22: CVE-2023-36281: An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. (https://nvd.nist.gov/vuln/detail/CVE-2023-36281)
- 2023-08-22: CVE-2023-36281: langchain vulnerable to arbitrary code execution (https://github.com/advisories/GHSA-7gfq-f96f-g85j)

## Sources

- 2023-08-22 GitHub Advisory Database: CVE-2023-36281: langchain vulnerable to arbitrary code execution https://github.com/advisories/GHSA-7gfq-f96f-g85j
- 2023-08-22 NVD: CVE-2023-36281: An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. https://nvd.nist.gov/vuln/detail/CVE-2023-36281

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.