Langchain vulnerabilities, page 3
51 vulnerabilities
Known vulnerabilities in Langchain products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.
CVE-2023-36258langchainlangchain+1
EPSS score1.07%
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.CVE-2023-39631langchainlangchain+2EPSS score1.60%
An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.CVE-2023-39659langchainlangchain+1EPSS score1.53%
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.CVE-2023-29374langchainlangchain+1EPSS score39.65%
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.CVE-2023-46229langchainlangchain+1EPSS score47.63%
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.CVE-2023-38896langchainlangchain+1EPSS score1.84%
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.CVE-2023-38860langchainlangchain+1EPSS score1.42%
An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.CVE-2023-44467langchainlangchain_experimental+1EPSS score1.04%
langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.CVE-2023-32786langchainlangchain+1EPSS score0.71%
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.CVE-2023-34541langchainlangchain+1EPSS score0.94%
Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.CVE-2023-34540langchainlangchain+1EPSS score1.68%
Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.