CVE-2024-27444: Critical severity Langchain langchain-experimental vulnerability
langchainexperimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by palchain/base.py.
Other sources
langchainexperimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not prohibited by palchain/base.py.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/langchain-experimentalto a version that resolves this vulnerability.Fixed in 0.0.52 - Upgrade
Upgrade
langchain_experimental (aka LangChain Experimental)to a version that resolves this vulnerability.Fixed in 0.0.52 - Upgrade
Upgrade
LangChainto a version that resolves this vulnerability.Fixed in 0.1.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27444?
CVE-2024-27444 is considered a high severity vulnerability that allows arbitrary code execution.
How do I fix CVE-2024-27444?
To fix CVE-2024-27444, upgrade langchain-experimental to version 0.0.52 or later.
What versions are affected by CVE-2024-27444?
CVE-2024-27444 affects langchain-experimental versions prior to 0.0.52.
What types of attacks can exploit CVE-2024-27444?
CVE-2024-27444 can be exploited via various Python built-in functions, allowing attackers to execute arbitrary code.
Is CVE-2024-27444 related to any previous vulnerabilities?
Yes, CVE-2024-27444 allows bypassing the fix for CVE-2023-44467.