CVE-2023-36095

Critical · CVSS 9.8

langchain — Arbitrary Code Execution via python exec() in PALChain

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-94

Description

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.

Search profile — drives PoC discovery

Symbols PALChainfrom_math_promptfrom_colored_object_promptexecPALpython_repl

Keywords CVE-2023-36095langchainPALChainarbitrary code executionexecfrom_math_promptfrom_colored_object_promptlangchain RCElangchain PALCWE-94langchain 0.0.194

Versions: 0.0.194

Affected packages

PyPI

langchain

0 → 0.0.236

References

https://github.com/hwchase17/langchain
https://github.com/langchain-ai/langchain/issues/5872
http://langchain.com
https://github.com/hwchase17/langchain
https://github.com/langchain-ai/langchain/issues/5872

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T18:30:39.000Z