GitHub Advisoryadvisory · PyPI

GHSA-p2qj-r53j-h3xj LangChain Experimental Eval Injection vulnerability

CRITICAL Published 2024-09-19 Modified 2026-10-27 Official page ↗
Aliases
CVE-2024-46946
Ecosystem
PyPI
Packages
langchain-experimental
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-95
Reviewed
2024-09-19

Affected packages

• PyPI langchain-experimental: >= 0.1.17, <= 0.3.0 (no fix yet)

Description

langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).

Related

Alias · CVE (1)

  • CVE-2024-46946 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through… vulnerability

Weakness · CWE (1)

  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References