CVE-2024-27444 LangChain Experimental vulnerable to arbitrary code execution

Critical 9.8 Published 26 Feb 2024 Updated 6 Aug 2024

Attackers can execute arbitrary code in LangChain Experimental by bypassing previous security fixes using Python dunder attributes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-27444?

CVE-2024-27444 is a critical code injection vulnerability in n/a, published on 26 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.

Weakness: CWE-749

Which versions are affected by CVE-2024-27444?

3 open source packages ship an affected version, including langchain-experimental. It affects 1 product.

Package	Affected	Fixed in
`langchain-experimental` PyPI	All versions	`0.0.52`
`langchain-experimental` PyPI	All versions	`0.0.52`
`langchain-experimental` PyPI	All versions	`0.0.52`

Products include Langchain Langchain-Experimental.

How do I fix CVE-2024-27444?

Upgrade langchain-experimental to 0.0.52 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-27444 being exploited?

There is no known exploitation of CVE-2024-27444 in the wild and no public exploit code.

Sources

Also known as GHSA-v8vj-cv27-hjv8, PYSEC-2026-375.