CVE-2023-44467: LangChain Experimental arbitrary code execution

# CVE-2023-44467: LangChain Experimental arbitrary code execution

https://gcdradar.vercel.app/incidents/cve-2023-44467-langchain-experimental-arbitrary-code-executi · AIR-2023-0063 · closed 2023-10-09

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2023-10-09
- AI role: Attack on AI
- Products: langchain_experimental
- CVE ids: CVE-2023-44467
- CVSS: 9.8

## Summary

LangChain Experimental allowed attackers to bypass previous fixes and execute arbitrary code via python imports. The package was updated to resolve the bypass.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-10-09: CVE-2023-44467: langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258… (https://nvd.nist.gov/vuln/detail/CVE-2023-44467)
- 2023-10-09: CVE-2023-44467: langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method (https://github.com/advisories/GHSA-gjjr-63x4-v8cq)

## Sources

- 2023-10-09 GitHub Advisory Database: CVE-2023-44467: langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method https://github.com/advisories/GHSA-gjjr-63x4-v8cq
- 2023-10-09 NVD: CVE-2023-44467: langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258… https://nvd.nist.gov/vuln/detail/CVE-2023-44467

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.