CVE-2024-27444Critical· 9.8▾ MidnightLangChain Experimental vulnerable to arbitrary code execution
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.
langchain-experimental < 0.0.52Upgrade to a patched release:
langchain-experimental 0.0.52Connected by shared product, vendor, weakness, or advisory.
CVE-2024-46946Critical· 9.8LangChain Experimental Eval Injection vulnerability
CVE-2018-10931Critical· 9.8Cobbler has Exposed Dangerous Method or Function
CVE-2026-102734Medium· 5.5asteval is a Python expression evaluator designed for restricted execution
GHSA-9w56-46f6-3qhxMedium· 5.5asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
CVE-2026-44798High· 7.1Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2026-92612Low· 1.0In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8