CriticalVulnerability
CVE-2024-27444: langchain_experimental code execution via Python attribute bypass in pal_chain
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-27444
- Published
- Record updated
- Affected
- langchain-experimental < 0.0.52
- Fixed in
- 0.0.52
- released February 19, 2024, 7 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.8%
Summary
CVE-2024-27444 affects langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8. An attacker can bypass the CVE-2023-44467 fix and execute arbitrary code by using attributes such as __import__, __subclasses__, __builtins__ or __globals__ in Python code, which pal_chain/base.py does not prohibit. The NVD assessment has not yet been provided.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langchain-experimentalPyPILLM dependency since 2023-07-21 · 1 tracked dependent
Related items
- MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
- InfoAddition by Subtraction: Toward Mitigating Fragile Safety Alignment in Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoSafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM ServingSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research