{"data":{"id":"6551f2fa-abb7-4573-97eb-5fe3768b8127","title":"CVE-2023-36188: An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the…","summary":"CVE-2023-36188 affects langchain v.0.0.64. A remote attacker can execute arbitrary code through the PALChain parameter in the Python exec method. The NIST NVD has not yet provided an assessment, and the weakness is classified as CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection').","solution":"The source references a patch at https://github.com/hwchase17/langchain/pull/6003, but it does not describe the fix, a fixed version or a workaround.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-36188","publishedAt":"2023-07-06T18:15:10.663Z","cveId":"CVE-2023-36188","cweIds":["CWE-74"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain@< 0.0.247 (fixed: 0.0.247)"],"affectedPackageNames":["langchain"],"affectedPackageRefs":["pypi:langchain"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","PALChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain remote code execution via PALChain parameter","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01895,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-57fc-8q82-gfp3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:55.667Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-07-29T00:17:38.401Z","daysToFix":23,"fixCheckedAt":"2026-10-29T21:46:57.975Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain","fixedVersion":"0.0.247","matchedVersion":"0.0.247","fixReleasedAt":"2023-07-29T00:17:38.401Z","daysToFix":23,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:57.824Z"}]}}