CodexGuild Knowledge Base

langchain vulnerable to arbitrary code execution

as of Aug 22, 2023 · applies to langchain < 0.0.312 · canonical · codexguild.com/kb/ghsa-7gfq-f96f-g85j · exported 2026-10-11

Canonical as of Aug 22, 2023

langchain vulnerable to arbitrary code execution

Critical severity. Affects langchain < 0.0.312. Upgrade to 0.0.312 or later.

CVE-2023-36281 / GHSA-7gfq-f96f-g85j · severity: critical · CVSS 9.8 · PyPI

Affected

langchain < 0.0.312 → fixed in 0.0.312

Details

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter. This is related to __subclasses__ or a template.

Source: GHSA-7gfq-f96f-g85j — GitHub Advisory Database (CC-BY-4.0).