CVE-2024-27444
Critical
Description
langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.
SeverityCritical
CVSS9.8
Exploit probability—
ProductLangchain-experimental
PublishedFeb 26, 2024
First seenFeb 26, 2024
Weakness typeCWE-749CWE-749
How to fix
Update
- langchain langchain-experimental0.1.8 or later
- langchain-experimental0.0.52 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| langchain langchain-experimental | v < 0.1.8 | 0.1.8 |
| langchain-experimentalPyPI | v < 0.0.52 | 0.0.52 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.