{"data":{"id":"ea737e84-03c5-4e4b-a791-193855336a51","title":"CVE-2023-36258: An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system…","summary":"CVE-2023-36258 affects LangChain before 0.0.236. Because Python code using os.system, exec, or eval can be used, an attacker can execute arbitrary code. The NVD has not yet provided an assessment, and the source references GitHub issue 5872 and CWE-94 (Improper Control of Generation of Code).","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-36258","publishedAt":"2023-07-04T01:15:09.797Z","cveId":"CVE-2023-36258","cweIds":["CWE-94"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain@< 0.0.247 (fixed: 0.0.247)"],"affectedPackageNames":["langchain"],"affectedPackageRefs":["pypi:langchain"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LangChain arbitrary code execution through os.system, exec, or eval","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01074,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-2qmj-7962-cjq8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:56.184Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-07-29T00:17:38.401Z","daysToFix":25,"fixCheckedAt":"2026-10-29T21:46:58.739Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain","fixedVersion":"0.0.247","matchedVersion":"0.0.247","fixReleasedAt":"2023-07-29T00:17:38.401Z","daysToFix":25,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:58.588Z"}]}}