CVE-2024-46946: Input Validation
langchainexperimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46946?
CVE-2024-46946 has a severity rating that indicates a significant risk because it allows for arbitrary code execution.
How do I fix CVE-2024-46946?
To mitigate CVE-2024-46946, you should upgrade langchain-experimental to version 0.3.1 or higher.
What software is affected by CVE-2024-46946?
CVE-2024-46946 affects versions 0.1.17 to 0.3.0 of the langchain-experimental package.
When was CVE-2024-46946 introduced?
CVE-2024-46946 was introduced in the langchain-experimental package with the release dated October 5, 2023.
What is LLMSymbolicMathChain in the context of CVE-2024-46946?
LLMSymbolicMathChain is a component of langchain-experimental that improperly allows for execution of arbitrary code via sympy.sympify.