AVID-2026-R1253

Description

Vulnerability CVE-2023-36281

Details

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to subclasses or a template.

Reason for inclusion in AVID: CVE-2023-36281 describes a remote code execution vulnerability in LangChain v0.0.171 via loading a JSON to load_prompt, enabling arbitrary code execution in AI app pipelines. LangChain is an AI framework commonly used in ML/AI stacks; the issue is in a software dependency used to build/train/deploy AI systems; thus a software supply chain vulnerability affecting AI systems.

References

• NVD entry
• https://github.com/hwchase17/langchain/issues/4394
• https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.312

Affected or Relevant Artifacts

• Developer: n/a
• Deployer: n/a
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2023-08-22
• Version: 0.3.3
• AVID Entry