Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-GJJR-63X4-V8CQ
HistoryOct 09, 2023 - 9:30 p.m.

langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method

2023-10-0921:30:27
GitHub Advisory Database
github.com
16
vulnerable
arbitrary code execution
bypass
palchain
python
cve-2023-36258 fix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

71.7%

JSON

langchain_experimental 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via the PALChain in the python exec method.

Affected configurations

Vulners
Node
langchainlangchain-experimentalRange≤0.0.14
VendorProductVersionCPE
langchainlangchain-experimental*cpe:2.3:a:langchain:langchain-experimental:*:*:*:*:*:*:*:*

Related

osv 8
nvd 3
cvelist 3
cve 3
nessus 1
veracode 2
prion 3
github 2
vulnrichment 1
thn 1
osv
osv
CVE-2023-44467
2023-10-09 20:15:10
langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method
2023-10-09 21:30:27
PYSEC-2023-194
2023-10-09 20:15:00
nvd
nvd
CVE-2023-44467
2023-10-09 20:15:10
CVE-2023-36258
2023-07-03 21:15:09
CVE-2024-27444
2024-02-26 16:28:00
cvelist
cvelist
CVE-2023-44467
2023-10-09 00:00:00
CVE-2023-36258
2023-07-03 00:00:00
CVE-2024-27444
2024-02-26 00:00:00
cve
cve
CVE-2023-44467
2023-10-09 20:15:10
CVE-2023-36258
2023-07-03 21:15:09
CVE-2024-27444
2024-02-26 16:28:00
nessus
nessus
LangChain Experimental Python Library <= 0.0.14 (CVE-2023-44467)
2024-09-11 00:00:00
veracode
veracode
Code Injection
2023-10-11 06:12:48
Remote Code Execution (RCE)
2023-07-11 01:25:11
prion
prion
Design/Logic Flaw
2023-10-09 20:15:00
Code injection
2023-07-03 21:15:00
Authentication flaw
2024-02-26 16:28:00
github
github
langchain arbitrary code execution vulnerability
2023-07-03 21:30:57
LangChain Experimental vulnerable to arbitrary code execution
2024-02-26 18:30:31
vulnrichment
vulnrichment
CVE-2024-27444
2024-02-26 00:00:00
thn
thn
Researchers Identify Over 20 Supply Chain Vulnerabilities in MLOps Platforms
2024-08-26 10:31:00

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

71.7%

JSON
Related for GHSA-GJJR-63X4-V8CQ
osv8nvd3cvelist3cve3nessus1veracode2prion3github2vulnrichment1thn1