LangChain Experimental Eval Injection vulnerability

langchain-experimental (pip)

langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).

First seen: 19 Sept 2024
Last update: 19 Sept 2024, 06:31 UTC
Identifiers: CVE-2024-46946
Source: GitHub advisory
On the menu as: PyPI packages
LLM gateways

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## LangChain Experimental Eval Injection vulnerability
Severity: critical. Patch status: no fix yet.
Affected: langchain-experimental (pip)
Ids: CVE-2024-46946

langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).

## Steps
1. This incident involves a provider (ai-gateways). Search config, CI and env templates (.env.example, wrangler.toml, vercel.json, terraform, workflow secrets) for credentials stored there. List each secret by name, where it is used, and how to rotate it. Never print secret values.
2. There is no fix yet. Until one ships: restrict network access to it.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2024-46946") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.sympy.org/latest/modules/codegen.html https://gist.github.com/12end/68c0c58d2564ef4141bccd4651480820#file-cve-2024-46946-txt https://github.com/advisories/GHSA-p2qj-r53j-h3xj https://github.com/langchain-ai/langchain/releases/tag/langchain-experimental%3D%3D0.3.0 https://nvd.nist.gov/vuln/detail/CVE-2024-46946
https://pwned.coffee/i/langchain-experimental-eval-injection-vulnerability-cve-2024-46946

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee