{"data":{"id":"4a16d742-d84c-4ecc-9d6a-dbae7381c311","title":"CVE-2023-44467: langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the…","summary":"CVE-2023-44467 affects langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306. An attacker can bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which pal_chain/base.py does not prohibit.","solution":"Reference: https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483 (patch). Fixed in LangChain 0.0.306 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-44467","publishedAt":"2023-10-10T00:15:10.480Z","cveId":"CVE-2023-44467","cweIds":null,"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-experimental@<= 0.0.14"],"affectedPackageNames":["langchain-experimental"],"affectedPackageRefs":["pypi:langchain-experimental"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","LangChain Experimental"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LangChain Experimental sandbox bypass allows arbitrary code execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01039,"epssCheckedAt":"2026-11-04T06:10:14.546Z","kevDateAdded":null,"advisoryAliases":["GHSA-gjjr-63x4-v8cq"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:45.546Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}