langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.
{ "github_reviewed_at": "2024-06-17T21:21:47Z", "severity": "HIGH", "cwe_ids": [ "CWE-276" ], "github_reviewed": true, "nvd_published_at": "2024-06-16T15:15:51Z" }