CVE-2023-36095
📋 TL;DR
This vulnerability in LangChain version 0.0.194 allows remote code execution through unsafe Python exec() calls in PALChain functions. Attackers can execute arbitrary code on systems running vulnerable LangChain instances. Anyone using the affected LangChain version with PALChain functionality is at risk.
💻 Affected Systems
- Harrison Chase LangChain
📦 What is this software?
Langchain by Langchain
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to data exfiltration, system manipulation, or service disruption.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, though risk remains elevated.
🎯 Exploit Status
Exploitation requires sending malicious input to vulnerable PALChain endpoints. The vulnerability is well-documented in public GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.0.195 and later
Vendor Advisory: https://github.com/langchain-ai/langchain/issues/5872
Restart Required: Yes
Instructions:
1. Update LangChain using pip: pip install --upgrade langchain>=0.0.195
2. Restart all services using LangChain
3. Verify the update with: pip show langchain
🔧 Temporary Workarounds
Disable PALChain functionality
allTemporarily disable or remove PALChain usage until patching is complete
# Remove or comment out PALChain imports and usage in your code
Input validation wrapper
allImplement strict input validation for all PALChain inputs
# Add input sanitization before passing to PALChain methods
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all PALChain inputs
- Run LangChain in isolated containers or sandboxes with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check LangChain version: pip show langchain | grep Version. If version is 0.0.194, you are vulnerable.Check Version:
pip show langchain | grep VersionVerify Fix Applied:
After updating, verify version is 0.0.195 or higher: pip show langchain | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusual Python exec() calls
- Suspicious PALChain method invocations
- Unexpected process spawns from LangChain
Network Indicators:
- Unusual outbound connections from LangChain processes
- Large data transfers following PALChain requests
SIEM Query:
process.name:python AND process.cmdline:*langchain* AND process.cmdline:*exec*