CVE-2023-36258
langchain arbitrary code execution vulnerability
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
- Record
CVE-2023-36258- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
- Record
CVE-2023-36258- Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2023-0122 No score
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
- Record
EUVD-2023-0122- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2qmj-7962-cjq8
langchain arbitrary code execution vulnerability
An issue in langchain allows an attacker to execute arbitrary code via the PALChain in the python exec method.
- Record
GHSA-2qmj-7962-cjq8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-2qmj-7962-cjq8
langchain arbitrary code execution vulnerability
An issue in langchain allows an attacker to execute arbitrary code via the PALChain in the python exec method.
- Record
GHSA-2qmj-7962-cjq8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
- Record
CVE-2023-36258- Updated
- 2026-11-02
OSVPYSEC-2023-98 No score
An issue in langchain v.0.0.199 allows an attacker to execute arbitrary code via the PALChain in the python exec method.
- Record
PYSEC-2023-98- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
langchainPyPI |
before 0.0.247 | 0.0.247 |
langchainPyPI |
before 0.0.247, plus listed versions 0.0.10.0.100.0.1000.0.1010.0.101rc0 Show 45 moreShow less0.0.1020.0.102rc00.0.1030.0.1040.0.1050.0.1060.0.1070.0.1080.0.1090.0.110.0.1100.0.1110.0.1120.0.1130.0.1140.0.1150.0.1160.0.1170.0.1180.0.1190.0.120.0.1200.0.1210.0.1220.0.1230.0.1240.0.1250.0.1260.0.1270.0.1280.0.1290.0.130.0.1300.0.1310.0.1320.0.1330.0.1340.0.1350.0.1360.0.1370.0.1380.0.1390.0.140.0.1400.0.141 |
0.0.247 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36258 is a critical vulnerability (CVSS 9.8) in Langchain, published July 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. Fixed in langchain 0.0.247.
References
github.com/hwchase17/langchain/issues/5872
nvd.nist.gov/vuln/detail/CVE-2023-36258
Show 7 moreShow less
Left out here: 200 versions. The JSON record has them.