CriticalVulnerabilityLLM-specific
CVE-2023-29374: LangChain LLMMathChain prompt injection leads to arbitrary code execution
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2023-29374
- Published
- Record updated
- Affected
- langchain <= 0.0.131
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 39.7%
Summary
CVE-2023-29374 affects LangChain through 0.0.131. Its LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method. NIST has not yet provided an NVD assessment, and the weakness is classified as CWE-74.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langchainPyPILLM dependency since 2022-10-25 · 31 tracked dependents
Topics
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database