Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-29374 EUVD-2023-0118GHSA-fprp-p869-w6q2PYSEC-2023-18

LangChain vulnerable to code injection

Published Apr 5, 2023 · Updated Feb 12, 2025 · Assigned by mitre

Package: langchain Ecosystem: PyPI

Description

In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI langchain <= 0.0.131 — GHSA-fprp-p869-w6q2
PyPI langchain < 0.0.132 0.0.132 PYSEC-2023-18

References