{"data":{"id":"da53774d-698f-4479-ad8b-7744f5da7d55","title":"CVE-2024-38459: langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an…","summary":"CVE-2024-38459 affects langchain_experimental (LangChain Experimental) before 0.0.61. The package provides Python REPL access without an opt-in step, and the issue exists because of an incomplete fix for CVE-2024-27444. The weakness is classified as CWE-276, Incorrect Default Permissions.","solution":"Patch: https://github.com/langchain-ai/langchain/compare/langchain-experimental==0.0.60...langchain-experimental==0.0.61 (fixed in langchain_experimental 0.0.61, per the linked patch comparison).","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-38459","publishedAt":"2024-06-16T19:15:51.840Z","cveId":"CVE-2024-38459","cweIds":["CWE-276"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-experimental@< 0.0.61 (fixed: 0.0.61)"],"affectedPackageNames":["langchain-experimental"],"affectedPackageRefs":["pypi:langchain-experimental"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","langchain_experimental","LangChain Experimental"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain_experimental Python REPL access without opt-in step","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00227,"epssCheckedAt":"2026-11-04T18:09:13.788Z","kevDateAdded":null,"advisoryAliases":["GHSA-wmvm-9vqv-5qpp"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:42.267Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-06-14T22:58:45.309Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:45:45.174Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain-experimental","fixedVersion":"0.0.61","matchedVersion":"0.0.61","fixReleasedAt":"2024-06-14T22:58:45.309Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:45.023Z"}]}}