CVE-2023-39631: Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library
Summary
CVE-2023-39631: Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library. Affects langchain versions < 0.0.308. Fixed in 0.0.308. How to fix ↓
Also tracked for
- numexpr · PyPI
The same CVE-2023-39631 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langchain is an AI-powered blockchain platform that provides a framework for developing decentralized applications. It is available on PyPI and can be installed using the package manager pip. The vulnerability in Langchain version 0.0.245 allows a remote attacker to execute arbitrary code by exploiting the evaluate function in the numexpr library.
Vulnerability Detail
The vulnerability arises from an issue in the evaluate function of the numexpr library used by Langchain. A remote attacker can exploit this vulnerability to execute arbitrary code on the target system. This can lead to various consequences, including unauthorized access, data manipulation, and potential compromise of the entire blockchain network. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 1.4.7 as of 22 Oct 2026
pip install --upgrade "langchain==1.4.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.308
This is the first release that contains the fix.
pip install --upgrade "langchain==0.0.308"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the security update provided by the Langchain developers to mitigate the risk of exploitation.
Conclusion
Langchain version 0.0.245 is vulnerable to arbitrary code execution due to a flaw in the evaluate function of the numexpr library. Users of Langchain are advised to update to the latest version that includes the necessary security patches. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for langchain →
FAQ
Langchain is an AI-powered blockchain platform that enables the development of decentralized applications.
This vulnerability allows a remote attacker to execute arbitrary code on the target system, potentially leading to unauthorized access, data manipulation, and compromise of the blockchain network.
To fix this vulnerability, it is recommended to update Langchain to the latest version that includes a patched version of the numexpr library.
No, there is no known workaround for this vulnerability. It is essential to apply the security update provided by the Langchain developers.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain.
