PyPI/langchain-experimental CVE-2024-21513: high 8.5, EPSS 1.89%

langchain-experimental vulnerable to Arbitrary Code Execution

Action: Upgrade langchain-experimental to 0.0.21 or later.

pip install langchain-experimental==0.0.21

Affected

Fixed versions

Sources

• osv: GHSA-cgcg-p68q-3w7v
• https://nvd.nist.gov/vuln/detail/CVE-2024-21513
• https://github.com/langchain-ai/langchain/commit/7b13292e3544b2f5f2bfb8a27a062ea2b0c34561
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py#L81
• https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py%23L81
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain-experimental/PYSEC-2024-62.yaml
• https://security.snyk.io/vuln/SNYK-PYTHON-LANGCHAINEXPERIMENTAL-7278171

CVE-2024-21513 · published 2024-07-15T06:30:53Z · modified 2024-11-22T05:42:52.433938Z · JSON