CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code…

PriorityP352critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.77%

50.9th percentile

langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
langchain	langchain-experimental	< 0.0.61	0.0.61
langchain	langchain-experimental	< 0.1.8	0.1.8
langchain	langchain-experimental	>= 0 < 0.0.61	0.0.61
langchain	langchain-experimental	>= 0 < ce0b0f22a175139df8f41cdcfb4d2af411112009	ce0b0f22a175139df8f41cdcfb4d2af411112009
langchain	langchain-experimental	>= 0 < 0.0.52	0.0.52

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ghsa9.8CRITICAL

osv9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.