An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobject_prompt.
"https://github.com/pypa/advisory-database/blob/main/vulns/langchain/PYSEC-2023-138.yaml"