CVE-2024-46946

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-46946
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46946.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-46946
Aliases
Published
2024-09-19T00:00:00Z
Modified
2026-10-21T02:51:40Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46946.json"
}
References

Affected packages

Git / github.com/langchain-ai/langchain

Affected ranges

Type
GIT
Repo
https://github.com/langchain-ai/langchain
Events
Introduced
14422a4220780cfca9afd564d99fecc3dfc3155a
Fixed
58c7414e10a00bb33f45ad5d1965ed44b3b4f0df
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:langchain:langchain-experimental:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.1.17"
                },
                {
                    "last_affected":  "0.3.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "original_tag":  "langchain-experimental==0.3.0",
            "range":  [
                {
                    "fixed":  "58c7414e10a00bb33f45ad5d1965ed44b3b4f0df"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

langchain-ai21==0.*
langchain-ai21==0.1.4
langchain-ai21==0.1.5
langchain-ai21==0.1.6
langchain-ai21==0.1.7
langchain-airbyte==0.*
langchain-airbyte==0.1.1
langchain-anthropic==0.*
langchain-anthropic==0.1.12
langchain-anthropic==0.1.13
langchain-anthropic==0.1.14rc1
langchain-anthropic==0.1.14rc2
langchain-anthropic==0.1.15
langchain-anthropic==0.1.16
langchain-anthropic==0.1.17
langchain-anthropic==0.1.18
langchain-anthropic==0.1.19
langchain-anthropic==0.1.20
langchain-anthropic==0.1.21
langchain-anthropic==0.1.22
langchain-anthropic==0.1.23
langchain-azure-dynamic-sessions==0.*
langchain-azure-dynamic-sessions==0.1.0
langchain-azure-dynamic-sessions==0.1.0rc0
langchain-box==0.*
langchain-box==0.1.0
langchain-chroma==0.*
langchain-chroma==0.1.1
langchain-chroma==0.1.2
langchain-cli==0.*
langchain-cli==0.0.22
langchain-cli==0.0.23
langchain-cli==0.0.24
langchain-cli==0.0.25
langchain-cli==0.0.26
langchain-cli==0.0.27
langchain-cli==0.0.28
langchain-cli==0.0.29
langchain-cli==0.0.30
langchain-community==0.*
langchain-community==0.0.37
langchain-community==0.2.0
langchain-community==0.2.0rc1
langchain-community==0.2.1
langchain-community==0.2.10
langchain-community==0.2.11
langchain-community==0.2.12
langchain-community==0.2.13
langchain-community==0.2.14
langchain-community==0.2.15
langchain-community==0.2.16
langchain-community==0.2.17
langchain-community==0.2.2
langchain-community==0.2.3
langchain-community==0.2.4
langchain-community==0.2.5
langchain-community==0.2.6
langchain-community==0.2.7
langchain-community==0.2.9
langchain-core==0.*
langchain-core==0.1.50
langchain-core==0.1.51
langchain-core==0.1.52
langchain-core==0.2.0
langchain-core==0.2.0rc1
langchain-core==0.2.1
langchain-core==0.2.10
langchain-core==0.2.11
langchain-core==0.2.12
langchain-core==0.2.13
langchain-core==0.2.15
langchain-core==0.2.16
langchain-core==0.2.17
langchain-core==0.2.18
langchain-core==0.2.19
langchain-core==0.2.2
langchain-core==0.2.20
langchain-core==0.2.21
langchain-core==0.2.22
langchain-core==0.2.23
langchain-core==0.2.24
langchain-core==0.2.25
langchain-core==0.2.26
langchain-core==0.2.27
langchain-core==0.2.28
langchain-core==0.2.29
langchain-core==0.2.29rc1
langchain-core==0.2.2rc1
langchain-core==0.2.3
langchain-core==0.2.30
langchain-core==0.2.31
langchain-core==0.2.32
langchain-core==0.2.33
langchain-core==0.2.34
langchain-core==0.2.35
langchain-core==0.2.36
langchain-core==0.2.37
langchain-core==0.2.38
langchain-core==0.2.39
langchain-core==0.2.4
langchain-core==0.2.40
langchain-core==0.2.5
langchain-core==0.2.6
langchain-core==0.2.7
langchain-core==0.2.8
langchain-core==0.2.9
langchain-core==0.3.0
langchain-couchbase==0.*
langchain-couchbase==0.0.1
langchain-couchbase==0.1.0
langchain-couchbase==0.1.1
langchain-exa==0.*
langchain-exa==0.1.0
langchain-experimental==0.*
langchain-experimental==0.0.58
langchain-experimental==0.0.59
langchain-experimental==0.0.60
langchain-experimental==0.0.61
langchain-experimental==0.0.62
langchain-experimental==0.0.63
langchain-experimental==0.0.64
langchain-experimental==0.0.65
langchain-fireworks==0.*
langchain-fireworks==0.1.3
langchain-fireworks==0.1.4
langchain-fireworks==0.1.5
langchain-fireworks==0.1.6
langchain-fireworks==0.1.7
langchain-groq==0.*
langchain-groq==0.1.10
langchain-groq==0.1.4
langchain-groq==0.1.5
langchain-groq==0.1.6
langchain-groq==0.1.8
langchain-groq==0.1.9
langchain-huggingface==0.*
langchain-huggingface==0.0.1
langchain-huggingface==0.0.2
langchain-huggingface==0.0.3
langchain-ibm==0.*
langchain-ibm==0.1.5
langchain-ibm==0.1.6
langchain-ibm==0.1.7
langchain-ibm==0.1.8
langchain-ibm==0.1.9
langchain-milvus==0.*
langchain-milvus==0.1.0
langchain-milvus==0.1.1
langchain-milvus==0.1.2
langchain-milvus==0.1.3
langchain-milvus==0.1.4
langchain-mistralai==0.*
langchain-mistralai==0.1.10
langchain-mistralai==0.1.11
langchain-mistralai==0.1.12
langchain-mistralai==0.1.13
langchain-mistralai==0.1.6
langchain-mistralai==0.1.7
langchain-mistralai==0.1.8
langchain-mistralai==0.1.9
langchain-mistralai==0.2.0
langchain-mongodb==0.*
langchain-mongodb==0.1.4
langchain-mongodb==0.1.5
langchain-mongodb==0.1.6
langchain-mongodb==0.1.7
langchain-mongodb==0.1.8
langchain-mongodb==0.1.9
langchain-nomic==0.*
langchain-nomic==0.1.0
langchain-nomic==0.1.1
langchain-nomic==0.1.2
langchain-ollama==0.*
langchain-ollama==0.1.0
langchain-ollama==0.1.1
langchain-ollama==0.1.2
langchain-ollama==0.1.3
langchain-openai==0.*
langchain-openai==0.1.10
langchain-openai==0.1.11
langchain-openai==0.1.12
langchain-openai==0.1.13
langchain-openai==0.1.14
langchain-openai==0.1.15
langchain-openai==0.1.16
langchain-openai==0.1.17
langchain-openai==0.1.19
langchain-openai==0.1.20
langchain-openai==0.1.21
langchain-openai==0.1.21rc1
langchain-openai==0.1.21rc2
langchain-openai==0.1.22
langchain-openai==0.1.23
langchain-openai==0.1.24
langchain-openai==0.1.25
langchain-openai==0.1.5
langchain-openai==0.1.6
langchain-openai==0.1.7
langchain-openai==0.1.8
langchain-openai==0.1.8rc1
langchain-openai==0.1.9
langchain-openai==0.2.0
langchain-pinecone==0.*
langchain-pinecone==0.1.1
langchain-pinecone==0.1.2
langchain-pinecone==0.1.3
langchain-prompty==0.*
langchain-prompty==0.0.1
langchain-prompty==0.0.2
langchain-prompty==0.0.3
langchain-qdrant==0.*
langchain-qdrant==0.0.1
langchain-qdrant==0.1.0
langchain-qdrant==0.1.1
langchain-qdrant==0.1.2
langchain-qdrant==0.1.3
langchain-robocorp==0.*
langchain-robocorp==0.0.10
langchain-robocorp==0.0.6
langchain-robocorp==0.0.7
langchain-robocorp==0.0.8
langchain-robocorp==0.0.9
langchain-robocorp==0.0.9.post1
langchain-text-splitters==0.*
langchain-text-splitters==0.0.2
langchain-text-splitters==0.2.0
langchain-text-splitters==0.2.1
langchain-text-splitters==0.2.2
langchain-text-splitters==0.2.4
langchain-text-splitters==0.3.0
langchain-together==0.*
langchain-together==0.1.1
langchain-together==0.1.2
langchain-together==0.1.3
langchain-together==0.1.4
langchain-together==0.1.5
langchain-unstructured==0.*
langchain-unstructured==0.1.0
langchain-unstructured==0.1.1
langchain-unstructured==0.1.2
langchain-upstage==0.*
langchain-upstage==0.1.4
langchain-upstage==0.1.5
langchain-voyageai==0.*
langchain-voyageai==0.1.1
langchain==0.*
langchain==0.1.17
langchain==0.2.0
langchain==0.2.0rc2
langchain==0.2.1
langchain==0.2.10
langchain==0.2.11
langchain==0.2.12
langchain==0.2.13
langchain==0.2.14
langchain==0.2.15
langchain==0.2.16
langchain==0.2.2
langchain==0.2.3
langchain==0.2.4
langchain==0.2.5
langchain==0.2.6
langchain==0.2.7
langchain==0.2.8
langchain==0.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46946.json"