← Back

CVE-2023-36258

nvd nist
Published: Jul 3, 2023Modified: Nov 22, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.

Affected (1)

Products: Langchain: Langchain
Langchain
1 product
Langchain
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Langchain
Version 0.0.199

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

Source: cve@mitre.org
ExploitIssue TrackingMitigation
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingMitigation

Timeline

No history available yet.