{"data":{"id":"3ffc9fd5-1aea-4bc8-9073-cd843137eb5f","title":"CVE-2024-21513: Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution…","summary":"Versions of the langchain-experimental package from 0.0.15 before 0.0.21 contain CVE-2024-21513, an arbitrary code execution flaw. When retrieving values from the database, the package calls 'eval' on all values. An attacker who controls the input prompt can run arbitrary Python code on servers configured with VectorSQLDatabaseChain.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-21513","publishedAt":"2024-07-15T09:15:01.857Z","cveId":"CVE-2024-21513","cweIds":["CWE-94","CWE-94"],"cvssScore":"8.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-experimental@>= 0, < 0.0.21 (fixed: 0.0.21)"],"affectedPackageNames":["langchain-experimental"],"affectedPackageRefs":["pypi:langchain-experimental"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["langchain-experimental","LangChain","VectorSQLDatabaseChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain-experimental arbitrary code execution when retrieving database values","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01893,"epssCheckedAt":"2026-11-04T06:10:14.105Z","kevDateAdded":null,"advisoryAliases":["GHSA-cgcg-p68q-3w7v"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:33.537Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-09-25T15:51:53.874Z","daysToFix":-294,"fixCheckedAt":"2026-10-29T21:45:41.839Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain-experimental","fixedVersion":"0.0.21","matchedVersion":"0.0.21","fixReleasedAt":"2023-09-25T15:51:53.874Z","daysToFix":-294,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:41.688Z"}]}}