PyPI/langchain CVE-2023-39659: critical 9.8, EPSS 1.53%

LangChain vulnerable to arbitrary code execution

Action: Upgrade langchain to 0.0.325 or later.

pip install langchain==0.0.325

Affected

Fixed versions

Sources

• osv: GHSA-prgp-w7vf-ch62
• https://nvd.nist.gov/vuln/detail/CVE-2023-39659
• https://github.com/langchain-ai/langchain/issues/7700
• https://github.com/langchain-ai/langchain/pull/12427
• https://github.com/langchain-ai/langchain/pull/5640
• https://github.com/langchain-ai/langchain/commit/cadfce295f8a33828fc635c2e5ea28b883e5c992
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.325
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-147.yaml

CVE-2023-39659 · published 2023-08-15T18:31:32Z · modified 2024-09-27T21:33:25.955251Z · JSON