LangChain Experimental vulnerable to arbitrary code execution

GHSA-v8vj-cv27-hjv8 · CVE-2024-27444 · PYSEC-2026-375 · 갱신 2026. 6. 29.

해야 할 일

langchain-experimental: 0.0.52 이상으로 올리세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	langchain-experimental	0.0.52

원문

LangChain Experimental vulnerable to arbitrary code execution

langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.

출처

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-27444
WEBhttps://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7
PACKAGEhttps://github.com/langchain-ai/langchain

오늘 목록으로

LangChain Experimental vulnerable to arbitrary code execution (GHSA-v8vj-cv27-hjv8) · Sieve