PyPI/langchain CVE-2023-38860: critical 9.8, EPSS 1.42%

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.

Action: Upgrade langchain to 0.0.247 or later.

pip install langchain==0.0.247

Affected

Fixed versions

Sources

• osv: PYSEC-2023-145
• https://github.com/langchain-ai/langchain/issues/7641
• https://github.com/advisories/GHSA-fj32-q626-pjjc

CVE-2023-38860 · published 2023-08-15T17:15:00Z · modified 2026-06-10T17:01:59.588223152Z · JSON