CVE-2024-38459: LangChain Experimental Python REPL code execution

# CVE-2024-38459: LangChain Experimental Python REPL code execution

https://gcdradar.vercel.app/incidents/cve-2024-38459-langchain-experimental-python-repl-code-execu · AIR-2024-0139 · closed 2024-06-16

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-06-16
- AI role: Attack on AI
- Products: langchain_experimental
- CVE ids: CVE-2024-38459
- CVSS: 7.8

## Summary

LangChain Experimental provided Python REPL access without an opt-in step due to an incomplete previous fix. The vulnerability allows code execution.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-06-16: CVE-2024-38459: langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in… (https://nvd.nist.gov/vuln/detail/CVE-2024-38459)
- 2024-06-16: CVE-2024-38459: langchain_experimental Code Execution via Python REPL access (https://github.com/advisories/GHSA-wmvm-9vqv-5qpp)

## Sources

- 2024-06-16 GitHub Advisory Database: CVE-2024-38459: langchain_experimental Code Execution via Python REPL access https://github.com/advisories/GHSA-wmvm-9vqv-5qpp
- 2024-06-16 NVD: CVE-2024-38459: langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in… https://nvd.nist.gov/vuln/detail/CVE-2024-38459

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.