Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if they can control the input prompt and the server is configured with VectorSQLDatabaseChain. Notes: Impact on the Confidentiality, Integrity and Availability of the vulnerable component: Confidentiality: Code execution happens within the impacted component, in this case langchain-experimental, so all resources are necessarily accessible. Integrity: There is nothing protected by the impacted component inherently. Although anything returned from the component counts as 'information' for which the trustworthiness can be compromised. Availability: The loss of availability isn't caused by the attack itself, but it happens as a result during the attacker's post-exploitation steps. Impact on the…
Recommended action: Upgrade to 0.0.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
langchainexperimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.
Recommended action: Upgrade to 0.0.61 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the `import`, `subclasses`, `builtins`, `globals`, `getattribute`, `bases`, `mro`, or `base` attribute in Python code. These are not prohibited by `pal_chain/base.py`.
Recommended action: Upgrade to 0.0.52 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.