CVE-2024-27444

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27444
langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7
https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7
Configurations

No configuration.

History

21 Nov 2024, 09:04

Type Values Removed Values Added
References () https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7 - () https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7 -

06 Aug 2024, 16:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
Summary
  • (es) langchain_experimental (también conocido como LangChain Experimental) en LangChain anterior a 0.1.8 permite a un atacante eludir la corrección CVE-2023-44467 y ejecutar código arbitrario a través de the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute en código Python. Estos no están prohibidos por pal_chain/base.py.
CWE CWE-749

26 Feb 2024, 16:32

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-26 16:28

Updated : 2024-11-21 09:04

NVD link : CVE-2024-27444

Mitre link : CVE-2024-27444

CVE.ORG link : CVE-2024-27444

JSON object : View

Products Affected

No product.

CWE
CWE-749

Exposed Dangerous Method or Function