CVE-2023-36281: langchain Arbitrary Code Execution
Summary
CVE-2023-36281: An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter. Affects langchain versions < 0.0.171. Fixed in 0.0.171. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
langchain is a Python package available on PyPI that provides language chain functionality. It allows users to process and manipulate language data using a variety of algorithms and techniques. The package is widely used in natural language processing and machine learning applications. However, version 0.0.171 of langchain is vulnerable to an arbitrary code execution attack.
Vulnerability Detail
The vulnerability in langchain version 0.0.171 arises from a flaw in the handling of json files passed to the 'load_prompt' parameter. A remote attacker can exploit this vulnerability by crafting a malicious json file and supplying it as input to the affected parameter. This can lead to the execution of arbitrary code on the target system. The impact of this vulnerability is severe, as an attacker can gain unauthorized access, modify data, or perform other malicious activities on the compromised system.
How To Fix
Latest published version: 1.4.7 as of 22 Oct 2026
pip install --upgrade "langchain==1.4.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.171
This is the first release that contains the fix.
pip install --upgrade "langchain==0.0.171"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the fixed version of langchain.
Conclusion
langchain version 0.0.171 is vulnerable to an arbitrary code execution attack. Users are advised to upgrade to the fixed version 0.0.171 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for langchain →
FAQ
langchain is a Python package that provides language chain functionality for processing and manipulating language data.
The vulnerability allows a remote attacker to execute arbitrary code on the target system, potentially leading to unauthorized access and malicious activities.
To fix this vulnerability, upgrade to version 0.0.171 or later of langchain.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
For more information, refer to the vulnerability advisory at https://github.com/pypa/advisory-database/blob/main/vulns/langchain/PYSEC-2023-151.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
