CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-36095
Critical (9.8) in langchain langchain. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in langchain 0.0.236.
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- langchain:langchain
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gwqq-6vq7-5j86 | PyPI | langchain | <0.0.236 | 0.0.236 |
| PYSEC-2023-138 | PyPI | langchain | <0.0.236 | 0.0.236 |