What is GHSA-92j5-3459-qgp4?

GHSA-92j5-3459-qgp4 is a security advisory published by GitHub Security Advisories with Critical severity. LangChain vulnerable to arbitrary code execution

Which CVE IDs does GHSA-92j5-3459-qgp4 cover?

GHSA-92j5-3459-qgp4 covers the following CVE IDs: CVE-2023-38896. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-92j5-3459-qgp4?

GHSA-92j5-3459-qgp4 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-92j5-3459-qgp4?

GHSA-92j5-3459-qgp4 affects 1 product, including: pip/langchain:\u003c 0.0.236.

GHSA-92j5-3459-qgp4CriticalCVSS 9.8

LangChain vulnerable to arbitrary code execution

Vendor

GitHub Security Advisories

Published

August 15, 2023

Last Modified

September 27, 2024

🔗 CVE IDs covered (1)

CVE-2023-38896 →

📋 Description

An issue in Harrison Chase langchain before version 0.0.236 allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.

🎯 Affected products1

pip/langchain:< 0.0.236

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2023-38896
https://github.com/hwchase17/langchain/issues/5872
https://github.com/hwchase17/langchain/pull/6003
https://twitter.com/llm_sec/status/1668711587287375876
https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137
https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e
https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-146.yaml
https://github.com/advisories/GHSA-92j5-3459-qgp4