CriticalVulnerability
CVE-2024-27444: langchain_experimental code execution via Python attribute bypass in pal_chain
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-27444
- Published
- Record updated
- Affected
- langchain-experimental < 0.0.52
- Fixed in
- 0.0.52
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.8%
Summary
CVE-2024-27444 affects langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8. An attacker can bypass the CVE-2023-44467 fix and execute arbitrary code by using attributes such as __import__, __subclasses__, __builtins__ or __globals__ in Python code, which pal_chain/base.py does not prohibit. The NVD assessment has not yet been provided.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- CriticalHermes Agent - PKCE Session Takeover via Redirect-URI Parser ConfusionSimilar attack · Tenable Research Advisories
- MediumGHSA-hmq2-7hp6-7crh: Banks: User-controlled prompt input can be parsed as privileged chat messagesSimilar attack · GitHub Advisory Database
- HighGHSA-6wjp-v33h-5cvq: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosureSimilar attack · GitHub Advisory Database
- HighCVE-2026-101998: Docker Sandboxes fail open when masking credentials in proxy responsesSimilar attack · NVD/CVE Database
- InfoCould LLM Watermark Detection be Public?Similar attack · Arxiv (cs.CR + cs.CL + cs.LG)