PyPI/langchain CVE-2023-36281: critical 9.8, EPSS 3.44%

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter.

Action: Upgrade langchain to 0.0.171 or later.

pip install langchain==0.0.171

Affected

Fixed versions

Sources

• osv: PYSEC-2023-151
• https://github.com/hwchase17/langchain/issues/4394
• https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55
• https://github.com/advisories/GHSA-7gfq-f96f-g85j

CVE-2023-36281 · published 2023-08-22T19:16:00Z · modified 2026-06-10T17:02:00.098771930Z · JSON