LangChain PALChain Code Injection
- Product
- LangChain LangChain
- CVE
- CVE-2023-36258
- Disclosed
- 2023-07-03
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- LangChain < 0.0.236
- Fixed
- 0.0.236 (PALChain moved to langchain-experimental)
Summary
LangChain's Program-Aided Language chain had the LLM write Python to solve problems and then executed it. Prompt injection let users get arbitrary code run on the host.
Root cause
PALChain generated a Python 'solution()' function via the LLM and ran it with exec(). Filtering was absent or bypassable, so a crafted question caused generated code to call os.system, exec or eval with attacker-chosen arguments.
Impact
Arbitrary code execution on servers exposing PALChain to user input.
Detection
Find dependencies on langchain < 0.0.236 using PALChain; review prompts containing os.system/exec/eval.
Mitigation
Upgrade, avoid executing model-generated code outside a sandbox, and move experimental chains behind strict input controls.