CVE-2023-36095

Summary

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/hwchase17/langchain
• http://langchain.com
• https://github.com/langchain-ai/langchain/issues/5872

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

References

• https://github.com/hwchase17/langchain
• https://github.com/langchain-ai/langchain/issues/5872

• ←Previous
• Next→