CVE-2023-36281

Published: Aug 22, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template.

Affected (1)

Products: Langchain: Langchain

Langchain

1 product

Langchain

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Langchain Langchain	Version 0.0.171

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (6)

https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/hwchase17/langchain/issues/4394

Source: cve@mitre.org

ExploitIssue TrackingVendor Advisory

https://github.com/langchain-ai/langchain/releases/tag/v0.0.312

Source: cve@mitre.org

https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/hwchase17/langchain/issues/4394

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingVendor Advisory

https://github.com/langchain-ai/langchain/releases/tag/v0.0.312

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.