diff --git a/advisories/github-reviewed/2023/10/GHSA-gjjr-63x4-v8cq/GHSA-gjjr-63x4-v8cq.json b/advisories/github-reviewed/2023/10/GHSA-gjjr-63x4-v8cq/GHSA-gjjr-63x4-v8cq.json index e7d3346914f..9abd3a645e9 100644 --- a/advisories/github-reviewed/2023/10/GHSA-gjjr-63x4-v8cq/GHSA-gjjr-63x4-v8cq.json +++ b/advisories/github-reviewed/2023/10/GHSA-gjjr-63x4-v8cq/GHSA-gjjr-63x4-v8cq.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-gjjr-63x4-v8cq", - "modified": "2024-02-26T19:54:46Z", + "modified": "2025-02-24T20:47:26Z", "published": "2023-10-09T21:30:27Z", "aliases": [ "CVE-2023-44467" ], "summary": "langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method", - "details": "langchain_experimental 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via the PALChain in the python exec method.", + "details": "langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.", "severity": [ { "type": "CVSS_V3",