CVE-2024-46946

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-46946

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46946.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-46946

Aliases

Published

2024-09-19T00:00:00Z

Modified

2026-07-08T06:35:16.381632760Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).

Database specific

{
    "unresolved_ranges": [
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "sympy.sympify"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46946.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/langchain-ai/langchain

Affected ranges

Type

GIT

Repo

https://github.com/langchain-ai/langchain

Events

Introduced

14422a4220780cfca9afd564d99fecc3dfc3155a

Fixed

58c7414e10a00bb33f45ad5d1965ed44b3b4f0df

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:langchain:langchain-experimental:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.1.17"
        },
        {
            "last_affected": "0.3.0"
        }
    ]
}

Affected versions

langchain-ai21==0.*

langchain-ai21==0.1.4

langchain-ai21==0.1.5

langchain-ai21==0.1.6

langchain-ai21==0.1.7

langchain-airbyte==0.*

langchain-airbyte==0.1.1

langchain-anthropic==0.*

langchain-anthropic==0.1.12

langchain-anthropic==0.1.13

langchain-anthropic==0.1.14rc1

langchain-anthropic==0.1.14rc2

langchain-anthropic==0.1.15

langchain-anthropic==0.1.16

langchain-anthropic==0.1.17

langchain-anthropic==0.1.18

langchain-anthropic==0.1.19

langchain-anthropic==0.1.20

langchain-anthropic==0.1.21

langchain-anthropic==0.1.22

langchain-anthropic==0.1.23

langchain-azure-dynamic-sessions==0.*

langchain-azure-dynamic-sessions==0.1.0

langchain-azure-dynamic-sessions==0.1.0rc0

langchain-box==0.*

langchain-box==0.1.0

langchain-chroma==0.*

langchain-chroma==0.1.1

langchain-chroma==0.1.2

langchain-cli==0.*

langchain-cli==0.0.22

langchain-cli==0.0.23

langchain-cli==0.0.24

langchain-cli==0.0.25

langchain-cli==0.0.26

langchain-cli==0.0.27

langchain-cli==0.0.28

langchain-cli==0.0.29

langchain-cli==0.0.30

langchain-community==0.*

langchain-community==0.0.37

langchain-community==0.2.0

langchain-community==0.2.0rc1

langchain-community==0.2.1

langchain-community==0.2.10

langchain-community==0.2.11

langchain-community==0.2.12

langchain-community==0.2.13

langchain-community==0.2.14

langchain-community==0.2.15

langchain-community==0.2.16

langchain-community==0.2.17

langchain-community==0.2.2

langchain-community==0.2.3

langchain-community==0.2.4

langchain-community==0.2.5

langchain-community==0.2.6

langchain-community==0.2.7

langchain-community==0.2.9

langchain-core==0.*

langchain-core==0.1.50

langchain-core==0.1.51

langchain-core==0.1.52

langchain-core==0.2.0

langchain-core==0.2.0rc1

langchain-core==0.2.1

langchain-core==0.2.10

langchain-core==0.2.11

langchain-core==0.2.12

langchain-core==0.2.13

langchain-core==0.2.15

langchain-core==0.2.16

langchain-core==0.2.17

langchain-core==0.2.18

langchain-core==0.2.19

langchain-core==0.2.2

langchain-core==0.2.20

langchain-core==0.2.21

langchain-core==0.2.22

langchain-core==0.2.23

langchain-core==0.2.24

langchain-core==0.2.25

langchain-core==0.2.26

langchain-core==0.2.27

langchain-core==0.2.28

langchain-core==0.2.29

langchain-core==0.2.29rc1

langchain-core==0.2.2rc1

langchain-core==0.2.3

langchain-core==0.2.30

langchain-core==0.2.31

langchain-core==0.2.32

langchain-core==0.2.33

langchain-core==0.2.34

langchain-core==0.2.35

langchain-core==0.2.36

langchain-core==0.2.37

langchain-core==0.2.38

langchain-core==0.2.39

langchain-core==0.2.4

langchain-core==0.2.40

langchain-core==0.2.5

langchain-core==0.2.6

langchain-core==0.2.7

langchain-core==0.2.8

langchain-core==0.2.9

langchain-core==0.3.0

langchain-couchbase==0.*

langchain-couchbase==0.0.1

langchain-couchbase==0.1.0

langchain-couchbase==0.1.1

langchain-exa==0.*

langchain-exa==0.1.0

langchain-experimental==0.*

langchain-experimental==0.0.58

langchain-experimental==0.0.59

langchain-experimental==0.0.60

langchain-experimental==0.0.61

langchain-experimental==0.0.62

langchain-experimental==0.0.63

langchain-experimental==0.0.64

langchain-experimental==0.0.65

langchain-fireworks==0.*

langchain-fireworks==0.1.3

langchain-fireworks==0.1.4

langchain-fireworks==0.1.5

langchain-fireworks==0.1.6

langchain-fireworks==0.1.7

langchain-groq==0.*

langchain-groq==0.1.10

langchain-groq==0.1.4

langchain-groq==0.1.5

langchain-groq==0.1.6

langchain-groq==0.1.8

langchain-groq==0.1.9

langchain-huggingface==0.*

langchain-huggingface==0.0.1

langchain-huggingface==0.0.2

langchain-huggingface==0.0.3

langchain-ibm==0.*

langchain-ibm==0.1.5

langchain-ibm==0.1.6

langchain-ibm==0.1.7

langchain-ibm==0.1.8

langchain-ibm==0.1.9

langchain-milvus==0.*

langchain-milvus==0.1.0

langchain-milvus==0.1.1

langchain-milvus==0.1.2

langchain-milvus==0.1.3

langchain-milvus==0.1.4

langchain-mistralai==0.*

langchain-mistralai==0.1.10

langchain-mistralai==0.1.11

langchain-mistralai==0.1.12

langchain-mistralai==0.1.13

langchain-mistralai==0.1.6

langchain-mistralai==0.1.7

langchain-mistralai==0.1.8

langchain-mistralai==0.1.9

langchain-mistralai==0.2.0

langchain-mongodb==0.*

langchain-mongodb==0.1.4

langchain-mongodb==0.1.5

langchain-mongodb==0.1.6

langchain-mongodb==0.1.7

langchain-mongodb==0.1.8

langchain-mongodb==0.1.9

langchain-nomic==0.*

langchain-nomic==0.1.0

langchain-nomic==0.1.1

langchain-nomic==0.1.2

langchain-ollama==0.*

langchain-ollama==0.1.0

langchain-ollama==0.1.1

langchain-ollama==0.1.2

langchain-ollama==0.1.3

langchain-openai==0.*

langchain-openai==0.1.10

langchain-openai==0.1.11

langchain-openai==0.1.12

langchain-openai==0.1.13

langchain-openai==0.1.14

langchain-openai==0.1.15

langchain-openai==0.1.16

langchain-openai==0.1.17

langchain-openai==0.1.19

langchain-openai==0.1.20

langchain-openai==0.1.21

langchain-openai==0.1.21rc1

langchain-openai==0.1.21rc2

langchain-openai==0.1.22

langchain-openai==0.1.23

langchain-openai==0.1.24

langchain-openai==0.1.25

langchain-openai==0.1.5

langchain-openai==0.1.6

langchain-openai==0.1.7

langchain-openai==0.1.8

langchain-openai==0.1.8rc1

langchain-openai==0.1.9

langchain-openai==0.2.0

langchain-pinecone==0.*

langchain-pinecone==0.1.1

langchain-pinecone==0.1.2

langchain-pinecone==0.1.3

langchain-prompty==0.*

langchain-prompty==0.0.1

langchain-prompty==0.0.2

langchain-prompty==0.0.3

langchain-qdrant==0.*

langchain-qdrant==0.0.1

langchain-qdrant==0.1.0

langchain-qdrant==0.1.1

langchain-qdrant==0.1.2

langchain-qdrant==0.1.3

langchain-robocorp==0.*

langchain-robocorp==0.0.10

langchain-robocorp==0.0.6

langchain-robocorp==0.0.7

langchain-robocorp==0.0.8

langchain-robocorp==0.0.9

langchain-robocorp==0.0.9.post1

langchain-text-splitters==0.*

langchain-text-splitters==0.0.2

langchain-text-splitters==0.2.0

langchain-text-splitters==0.2.1

langchain-text-splitters==0.2.2

langchain-text-splitters==0.2.4

langchain-text-splitters==0.3.0

langchain-together==0.*

langchain-together==0.1.1

langchain-together==0.1.2

langchain-together==0.1.3

langchain-together==0.1.4

langchain-together==0.1.5

langchain-unstructured==0.*

langchain-unstructured==0.1.0

langchain-unstructured==0.1.1

langchain-unstructured==0.1.2

langchain-upstage==0.*

langchain-upstage==0.1.4

langchain-upstage==0.1.5

langchain-voyageai==0.*

langchain-voyageai==0.1.1

langchain==0.*

langchain==0.1.17

langchain==0.2.0

langchain==0.2.0rc2

langchain==0.2.1

langchain==0.2.10

langchain==0.2.11

langchain==0.2.12

langchain==0.2.13

langchain==0.2.14

langchain==0.2.15

langchain==0.2.16

langchain==0.2.2

langchain==0.2.3

langchain==0.2.4

langchain==0.2.5

langchain==0.2.6

langchain==0.2.7

langchain==0.2.8

langchain==0.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46946.json"