CVE-2023-36095

CriticalCVSS 9.8/10Last modified Jul 9, 2026

Description

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/hwchase17/langchainProduct
https://github.com/langchain-ai/langchain/issues/5872Exploit, Issue Tracking, Vendor Advisory
https://github.com/hwchase17/langchainProduct
https://github.com/langchain-ai/langchain/issues/5872Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Aug 5, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-360979.8funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.CVE-2023-36107.8A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. CVE-2023-361009.8An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter CVE-2023-361039.8Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands CVE-2023-361067.5An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the inte CVE-2023-361099.8Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_ra CVE-2023-36117.8An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalati CVE-2023-361185.4Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a cr CVE-2023-36128.8Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially cr CVE-2023-361215.4Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SE CVE-2023-361237.8Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code CVE-2023-361266.1There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0