Threat database

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 1.4%	CVE-2024-46946langchain-experimental · n/a Critical9.8EPSS 1.4%2024-09-19CVE Database V5CVE-2024-46946 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). EPSS 1.4%Vulnerability	CVE Database V5	2024-09-19
High	7.8	EPSS 0.2%	CVE-2024-38459langchain-experimental · n/a High7.8EPSS 0.2%2024-06-16CVE Database V5CVE-2024-38459 langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444. EPSS 0.2%Vulnerability	CVE Database V5	2024-06-16
Critical	9.8	EPSS 0.8%	CVE-2024-27444langchain-experimental · n/a Critical9.8EPSS 0.8%2024-02-26CVE Database V5CVE-2024-27444 langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py. EPSS 0.8%Vulnerability	CVE Database V5	2024-02-26

Page 1 of 1