CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code execution

# CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code execution

https://gcdradar.vercel.app/incidents/cve-2024-27444-langchain-experimental-vulnerable-to-arbitrar · AIR-2024-0078 · closed 2024-02-26

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-02-26
- AI role: Attack on AI
- Products: LangChain Experimental
- CVE ids: CVE-2024-27444
- CVSS: 9.8

## Summary

LangChain Experimental allows attackers to bypass previous security controls and execute arbitrary Python code. This issue arises from improper restriction of dangerous attributes and methods.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-02-26: CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix… (https://nvd.nist.gov/vuln/detail/CVE-2024-27444)
- 2024-02-26: CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code execution (https://github.com/advisories/GHSA-v8vj-cv27-hjv8)

## Sources

- 2024-02-26 GitHub Advisory Database: CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code execution https://github.com/advisories/GHSA-v8vj-cv27-hjv8
- 2024-02-26 NVD: CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix… https://nvd.nist.gov/vuln/detail/CVE-2024-27444

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.