{"data":{"id":"3382b9a9-8903-4c6b-b336-2d738c1735d4","title":"CVE-2023-29374: In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code…","summary":"CVE-2023-29374 affects LangChain through 0.0.131. Its LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method. NIST has not yet provided an NVD assessment, and the weakness is classified as CWE-74.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-29374","publishedAt":"2023-04-05T06:15:37.340Z","cveId":"CVE-2023-29374","cweIds":["CWE-74","CWE-74"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["langchain@<= 0.0.131"],"affectedPackageNames":["langchain"],"affectedPackageRefs":["pypi:langchain"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","LLMMathChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LangChain LLMMathChain prompt injection leads to arbitrary code execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.39653,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-fprp-p869-w6q2"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:03.291Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}