Langchain Experimental vulnerabilities

4 known vulnerabilities in Langchain Experimental from LangChain. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows…

  CVE-2024-46946Sep 19, 2024LangChainEPSS 1.39%

  langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbe

• 8.5 High severity

  langchain-experimental: Improper Control of Generation of Code

  CVE-2024-21513Jul 15, 2024Langchain-experimentalEPSS 1.89%

  Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and

• 7.8 High severity

  langchain_experimental: Incorrect Default Permissions

  CVE-2024-38459Jun 16, 2024LangChain

  langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.

• 9.8 Critical severity

  langchain_experimental: Exposed Dangerous Method or Function

  CVE-2024-27444Feb 26, 2024LangChain

  langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or