What is GHSA-7gfq-f96f-g85j?

GHSA-7gfq-f96f-g85j is a security advisory published by GitHub Security Advisories with Critical severity. langchain vulnerable to arbitrary code execution

Which CVE IDs does GHSA-7gfq-f96f-g85j cover?

GHSA-7gfq-f96f-g85j covers the following CVE IDs: CVE-2023-36281. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7gfq-f96f-g85j?

GHSA-7gfq-f96f-g85j has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-7gfq-f96f-g85j?

GHSA-7gfq-f96f-g85j affects 1 product, including: pip/langchain:\u003c 0.0.312.

GHSA-7gfq-f96f-g85jCriticalCVSS 9.8

langchain vulnerable to arbitrary code execution

Vendor

GitHub Security Advisories

Published

August 22, 2023

Last Modified

September 30, 2024

🔗 CVE IDs covered (1)

CVE-2023-36281 →

📋 Description

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter. This is related to __subclasses__ or a template.

🎯 Affected products1

pip/langchain:< 0.0.312

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2023-36281
https://github.com/hwchase17/langchain/issues/4394
https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55
https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-151.yaml
https://github.com/langchain-ai/langchain/pull/10252
https://github.com/langchain-ai/langchain/commit/22abeb9f6cc555591bf8e92b5e328e43aa07ff6c
https://github.com/langchain-ai/langchain/releases/tag/v0.0.312
https://github.com/advisories/GHSA-7gfq-f96f-g85j