PyPI/langchain CVE-2023-36258: critical 9.8, EPSS 1.07%

langchain arbitrary code execution vulnerability

Action: Upgrade langchain to 0.0.247 or later.

pip install langchain==0.0.247

Affected

Fixed versions

Sources

• osv: GHSA-2qmj-7962-cjq8
• https://nvd.nist.gov/vuln/detail/CVE-2023-36258
• https://github.com/langchain-ai/langchain/issues/5872
• https://github.com/langchain-ai/langchain/issues/5872#issuecomment-1697785619
• https://github.com/langchain-ai/langchain/pull/6003
• https://github.com/langchain-ai/langchain/pull/7870
• https://github.com/langchain-ai/langchain/pull/8425
• https://github.com/langchain-ai/langchain/commit/8ba9835b925473655914f63822775679e03ea137
• https://github.com/langchain-ai/langchain/commit/e294ba475a355feb95003ed8f1a2b99942509a9e
• https://github.com/langchain-ai/langchain/commit/fab24457bcf8ede882abd11419769c92bc4e7751
• https://github.com/hwchase17/langchain
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-98.yaml

CVE-2023-36258 · published 2023-07-03T21:30:57Z · modified 2024-11-22T23:04:53.400191Z · JSON