{"id":"CVE-2024-46946","kind":"vulnerability","aliases":["CVE-2024-46946","GHSA-p2qj-r53j-h3xj"],"related":[],"title":"LangChain Experimental Eval Injection vulnerability","description":"langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05).","summary":"LangChain Experimental versions 0.1.17 through 0.3.0 pass model-generated text to sympy.sympify, which uses eval, inside LLMSymbolicMathChain. An attacker who can steer the model's input can execute arbitrary Python code on the server running the chain.","severity":"critical","cvss":9.8,"epss":0.01387,"exploited":false,"exploited_at":null,"products":[{"name":"langchain-experimental","fixed":[],"affected":">= 0.1.17, <= 0.3.0","ecosystem":"pypi"},{"name":"langchain langchain-experimental","fixed":[],"affected":">= 0.1.17, <= 0.3.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-apps","ai-tooling","cwe-95","langchain","llm-pipelines","python"],"not_affected_if":["chain-not-used","pinned-outside-range"],"how_to_check":"- Run `pip show langchain-experimental` and check whether the version is between `0.1.17` and `0.3.0`\n- Search the codebase for `LLMSymbolicMathChain` to see whether the chain is used at all","fix":"- Upgrade `langchain-experimental` to a version newer than `0.3.0` (the sources do not name the exact fixed version; check the GHSA page)\n- Remove or disable `LLMSymbolicMathChain` if it is not needed","status":"open","published_at":"2024-09-19T05:15:11+00:00","first_seen_at":"2026-10-27T16:56:21+00:00","triaged_at":"2026-10-27T16:56:39+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T16:56:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `langchain-experimental` to a version newer than `0.3.0` (the sources do not name the exact fixed version; check the GHSA page)\n- Remove or disable `LLMSymbolicMathChain` if it is not needed","reach":"unknown","title":"LangChain Experimental: eval injection lets attackers run arbitrary code","impact":"high","summary":"LangChain Experimental versions 0.1.17 through 0.3.0 pass model-generated text to sympy.sympify, which uses eval, inside LLMSymbolicMathChain. An attacker who can steer the model's input can execute arbitrary Python code on the server running the chain.","category":"ai-tooling","nicknames":[],"who_cares":["python","langchain","ai-apps","llm-pipelines"],"confidence":0.8,"needs_auth":"unknown","worst_case":"code runs on the server with the application's privileges","analyst_note":"Confirm the fixed version from GHSA-p2qj-r53j-h3xj and whether an attacker needs control of the chain input, which the sources do not state.","how_to_check":"- Run `pip show langchain-experimental` and check whether the version is between `0.1.17` and `0.3.0`\n- Search the codebase for `LLMSymbolicMathChain` to see whether the chain is used at all","needs_analyst":true,"not_affected_if":["chain-not-used","pinned-outside-range"],"who_is_affected":"Applications that import langchain-experimental in this version range and actually run LLMSymbolicMathChain on input that a user or external data source can influence. Teams that do not use this chain, or that run the package only in offline tooling with trusted input, are at much lower risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00065,"input_tokens":3405,"output_tokens":618,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-05':105C '-10':104C '-2024':7A,15A '-46946':8A,16A '-95':31B '0.1.17':40B,80C '0.3.0':42B,82C '2023':103C 'ai':25B,28B 'ai-app':24B 'ai-tool':27B 'aka':77C 'allow':85C 'app':26B 'arbitrari':66B,89C 'attack':56B,86C 'chain':74B 'code':68B,90C 'cve':6A,14A 'cwe':30B 'eval':3A,52B,95C 'execut':65B,88C 'experiment':2A,38B,76C,79C 'experimental':19A,23A 'fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6':102C 'generat':46B 'ghsa':10A 'ghsa-p2qj-r53j-h3xj':9A 'h3xj':13A 'inject':4A 'input':63B 'insid':53B 'introduc':100C 'langchain':1A,18A,20A,22A,32B,37B,75C,78C,84C 'langchain-experimental':17A,21A 'llm':34B 'llm-pipelin':33B 'llmsymbolicmathchain':54B,97C,98C 'model':45B,61B 'model-gener':44B 'p2qj':11A 'pass':43B 'pipelin':35B 'python':36B,67B 'r53j':12A 'run':72B 'server':71B 'steer':59B 'sympy.sympify':49B,92C 'text':47B 'tool':29B 'use':51B,94C 'version':39B 'vulner':5A","nicknames":[],"mitigations":[],"who_affected":"Applications that import langchain-experimental in this version range and actually run LLMSymbolicMathChain on input that a user or external data source can influence. Teams that do not use this chain, or that run the package only in offline tooling with trusted input, are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-09-19T05:15:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p2qj-r53j-h3xj","url":"https://github.com/advisories/GHSA-p2qj-r53j-h3xj","severity":"critical","published_at":"2024-09-19T06:31:36+00:00","modified_at":"2026-10-27T16:52:57+00:00","first_seen_at":"2026-10-27T16:56:21+00:00","fetched_at":"2026-10-27T17:11:59+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-46946","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46946","severity":null,"published_at":"2024-09-19T05:15:11+00:00","modified_at":"2026-06-17T07:56:14+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}