CVE-2023-36258: langchain Code Injection
CVSS: 9.8v3.1CriticalModified
AliasesGHSA-2qmj-7962-cjq8PYSEC-2023-98
Published 03-07-2023Last modified 22-11-2024
Vulnerability summary
CVE-2023-36258 is a critical (CVSS 9.8) Code Injection vulnerability in langchain. EPSS estimates a 1.07% chance of exploitation in the next 30 days, higher than 64.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
1.07%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 03-07-2023PublishedVulnerability first disclosed.
- 22-11-2024Last modifiedVulnerability information updated.
Description
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.3Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesSingle source
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.07%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.07% on 19-09-2026
19-09-202619-10-2026
EPSS score1.07%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLangchain
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Langchain1 product
- langchain0.0.199
PyPI1 product
- langchain< 0.0.247
2 vendors · 2 products
