LangChain (PALChain): Arbitrary code execution via `os.system`/`exec` in generated code

CVE-2023-36258AI/ML frameworks & servingcurated

Impact

Arbitrary code execution via os.system/exec in generated code

Who can reach it

Untrusted prompt input

What to do

Upgrade past 0.0.236; the fix was bypassed twice (see below)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-36258

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.