{"id":"CVE-2023-36258","published":"2023-07-03T00:00:00Z","modified":"2024-11-22T16:46:55Z","title":"An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system…","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01074,"percentile":0.64824,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/hwchase17/langchain/issues/5872","tags":[]}],"priority":{"score":13.0,"factors":[{"name":"EPSS percentile","points":12.96}]},"affected":[{"ecosystem":"PyPI","package":"langchain","vulnerableRanges":["<0.0.247"],"patched":["0.0.247"],"from":["GHSA-2qmj-7962-cjq8","PYSEC-2023-98"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0122","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-langchain-experimental-cve-2023-36258","children":[{"from":"CVE-2023-36258","to":"CVE-2023-44467","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.","from":"CVE.org","in":"CVE-2023-44467"}]}]}}