langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).

Affected Packages

PyPI langchain-experimental

Affected versions: 0.1.17 (last affected: 0.3.0)

Related CVEs

CVE-2024-46946

Key Information

GHSA ID

GHSA-p2qj-r53j-h3xj

Published

September 19, 2024 6:31 AM

Last Modified

September 19, 2024 6:23 PM

CVSS Score

9.0 /10

Primary Ecosystem

PyPI

Primary Package

langchain-experimental

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 16, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.