{"id":"CVE-2024-27444","kind":"vulnerability","aliases":["CVE-2024-27444","GHSA-v8vj-cv27-hjv8"],"related":[],"title":"LangChain Experimental vulnerable to arbitrary code execution","description":"langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the `__import__`, `__subclasses__`, `__builtins__`, `__globals__`, `__getattribute__`, `__bases__`, `__mro__`, or `__base__` attribute in Python code. These are not prohibited by `pal_chain/base.py`.","summary":"LangChain Experimental before 0.0.52 fails to block dangerous Python dunder attributes such as __import__, __subclasses__ and __globals__ in its PAL chain, bypassing the earlier CVE-2023-44467 fix. An attacker who can get text into the chain's input can execute arbitrary code on the host running it.","severity":"critical","cvss":9.8,"epss":0.00773,"exploited":false,"exploited_at":null,"products":[{"name":"langchain-experimental","fixed":["0.0.52"],"affected":"< 0.0.52","ecosystem":"pypi"},{"name":"langchain langchain-experimental","fixed":["0.1.8"],"affected":"< 0.1.8","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-agents","ai-tooling","cwe-749","langchain","pypi","python"],"not_affected_if":["not-using-pal-chain","trusted-input-only"],"how_to_check":"- Run `pip show langchain-experimental` and confirm the version is below `0.0.52`.\n- Check whether the application uses `PALChain` or `pal_chain` from `langchain_experimental`.","fix":"- Upgrade `langchain-experimental` to `0.0.52` or later.\n- Upgrade `langchain` to `0.1.8` or later if it is used alongside the experimental package.","status":"open","published_at":"2024-02-26T16:28:00+00:00","first_seen_at":"2026-10-27T16:56:21+00:00","triaged_at":"2026-10-27T16:56:39+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-27T16:56:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `langchain-experimental` to `0.0.52` or later.\n- Upgrade `langchain` to `0.1.8` or later if it is used alongside the experimental package.","reach":"internet","title":"LangChain Experimental: dunder attribute bypass lets attackers run arbitrary Python code","impact":"high","summary":"LangChain Experimental before 0.0.52 fails to block dangerous Python dunder attributes such as __import__, __subclasses__ and __globals__ in its PAL chain, bypassing the earlier CVE-2023-44467 fix. An attacker who can get text into the chain's input can execute arbitrary code on the host running it.","category":"ai-tooling","nicknames":[],"who_cares":["python","langchain","ai-agents","pypi"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker runs arbitrary Python code on the server hosting the chain.","analyst_note":"Confirm the fixed version and the exact PAL chain entry points at https://github.com/advisories/GHSA-v8vj-cv27-hjv8.","how_to_check":"- Run `pip show langchain-experimental` and confirm the version is below `0.0.52`.\n- Check whether the application uses `PALChain` or `pal_chain` from `langchain_experimental`.","needs_analyst":true,"not_affected_if":["not-using-pal-chain","trusted-input-only"],"who_is_affected":"Applications that use the LangChain Experimental PAL chain (pal_chain) with input that can come from users or untrusted content are exposed, because the chain executes model-generated Python. Systems that do not use langchain_experimental, or that never route untrusted text into PAL chains, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000659,"input_tokens":3425,"output_tokens":633,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2023':62B,103C '-2024':9A,17A '-27444':10A,18A '-44467':63B,104C '-749':33B '0.0.52':40B,90C '0.1.8':95C 'agent':28B 'ai':27B,30B 'ai-ag':26B 'ai-tool':29B 'aka':86C 'allow':96C 'arbitrari':5A,78B,108C 'attack':66B,98C 'attribut':47B,121C 'base':117C,120C 'block':43B 'builtin':114C 'bypass':58B,100C 'chain':57B,73B 'chain/base.py':131C 'code':6A,79B,109C,124C 'cv27':14A 'cve':8A,16A,61B,102C 'cwe':32B 'danger':44B 'dunder':46B 'earlier':60B 'execut':7A,77B,107C 'experiment':2A,38B,85C,88C 'experimental':21A,25A 'fail':41B 'fix':64B,105C 'get':69B 'getattribut':116C 'ghsa':12A 'ghsa-v8vj-cv27-hjv8':11A 'global':53B,115C 'hjv8':15A 'host':82B 'import':50B,112C 'input':75B 'langchain':1A,20A,22A,24A,34B,37B,84C,87C,93C 'langchain-experimental':19A,23A 'mro':118C 'pal':56B,130C 'part':91C 'prohibit':128C 'pypi':35B 'python':36B,45B,123C 'run':83B 'subclass':51B,113C 'text':70B 'tool':31B 'v8vj':13A 'via':110C 'vulner':3A","nicknames":[],"mitigations":[],"who_affected":"Applications that use the LangChain Experimental PAL chain (pal_chain) with input that can come from users or untrusted content are exposed, because the chain executes model-generated Python. Systems that do not use langchain_experimental, or that never route untrusted text into PAL chains, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-02-26T16:28:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-v8vj-cv27-hjv8","url":"https://github.com/advisories/GHSA-v8vj-cv27-hjv8","severity":"critical","published_at":"2024-02-26T18:30:31+00:00","modified_at":"2026-10-27T16:51:18+00:00","first_seen_at":"2026-10-27T16:56:21+00:00","fetched_at":"2026-10-27T16:56:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-27444","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27444","severity":null,"published_at":"2024-02-26T16:28:00+00:00","modified_at":"2026-06-17T07:19:54+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}