CVE-2024-46946: LangChain Experimental Eval Injection vulnerability

# CVE-2024-46946: LangChain Experimental Eval Injection vulnerability

https://gcdradar.vercel.app/incidents/cve-2024-46946-langchain-experimental-eval-injection-vulnera · AIR-2024-0170 · closed 2024-09-19

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-09-19
- AI role: Attack on AI
- Products: LangChain Experimental
- CVE ids: CVE-2024-46946
- CVSS: 9.8

## Summary

A critical eval injection vulnerability in LangChain Experimental allows attackers to execute arbitrary code via sympy.sympify within LLMSymbolicMathChain. The flaw impacts multiple versions of the library.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-09-19: CVE-2024-46946: langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code… (https://nvd.nist.gov/vuln/detail/CVE-2024-46946)
- 2024-09-19: CVE-2024-46946: LangChain Experimental Eval Injection vulnerability (https://github.com/advisories/GHSA-p2qj-r53j-h3xj)

## Sources

- 2024-09-19 GitHub Advisory Database: CVE-2024-46946: LangChain Experimental Eval Injection vulnerability https://github.com/advisories/GHSA-p2qj-r53j-h3xj
- 2024-09-19 NVD: CVE-2024-46946: langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code… https://nvd.nist.gov/vuln/detail/CVE-2024-46946

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.