PyPI: langchain-experimental
CVE-2024-21513
Safety vulnerability ID: SFTY-20240715-04015
Safety legacy ID: pyup.io-72182
Affected versions of langchain-experimental are vulnerable to Arbitrary Code Execution. When retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if they can control the input prompt and the server is configured with VectorSQLDatabaseChain.
Overview
langchain-experimental vulnerable to Arbitrary Code Execution
Advisory
Affected versions of langchain-experimental are vulnerable to Arbitrary Code Execution. When retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and execute arbitrary python code if they can control the input prompt and the server is configured with VectorSQLDatabaseChain.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240715-04015/CVE-2024-21513
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21513
- https://github.com/advisories/GHSA-cgcg-p68q-3w7v
- https://github.com/langchain-ai/langchain/commit/7b13292e3544b2f5f2bfb8a27a062ea2b0c34561
- https://github.com/langchain-ai/langchain/pull/10937
- https://nvd.nist.gov/vuln/detail/CVE-2024-21513
- https://github.com/langchain-ai/langchain/commit/7b13292e3544b2f5f2bfb8a27a062ea2b0c34561
- https://security.snyk.io/vuln/SNYK-PYTHON-LANGCHAINEXPERIMENTAL-7278171
- https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py#L81
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain-experimental/PYSEC-2024-62.yaml
- https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py%23L81
- https://github.com/advisories/GHSA-cgcg-p68q-3w7v
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more