CVE-2023-44467

—

CVSS 3.1

9.8 critical

EPSS

<1%p59

Published

Oct 9, 2023 (Oct 9, 2023)

Modified

Jun 17, 2026

Description

langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.

Vendors: langchain
Products: langchain experimental
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news1 stories

Researchers Identify Over 20 Supply Chain Vulnerabilities in MLOps Platforms

The Hacker NewsAug 28, 03:53 UTC · Aug 28, 2024Vulnerability CVE-2024-27132 CVE-2023-48022 CVE-2023-46229+1 CVEs