High

LangChain PALChain Python Exec RCE (CVE-2023-36258)

LangChain versions up to 0.0.64 include a feature called PALChain that generates Python code from a prompt and then runs it directly with no safety checks. An attacker who controls or influences the prompt can make PALChain generate code that calls out to the operating system, giving them command execution on the host running the application.

How the attack works

An application uses LangChain's PALChain to turn a natural-language problem into a Python program and execute it. LangChain feeds that generated program straight into Python's exec() without sanitizing it. Because the generated code always follows a predictable 'def solution():' template, an attacker can shape their input so the generated function calls os.system, subprocess, __import__('os'), or pty.spawn. When that code runs, the attacker gets arbitrary command execution on the server.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
7c3f9a2e-5b41-4d68-9e0a-2f6b8c1d34a5
Severity
High

Why it matters

An attacker can execute arbitrary operating system commands on the machine running the vulnerable LangChain application, which can lead to full compromise of that host, data theft, or further access into the environment.

What you can do

  • →Upgrade past LangChain 0.0.64 or stop using PALChain if you cannot upgrade.
  • →Never pass untrusted or user-supplied input into PALChain or any component that generates and executes code automatically.
  • →Run any code-generation-and-execution feature in a sandboxed, isolated environment with no access to sensitive systems or credentials.
  • →Review logs for process executions where a Python interpreter is launched with inline code referencing os.system, subprocess, or __import__('os') alongside a PALChain-style 'def solution():' pattern.

Known benign look-alikes

  • LangChain maintainers or downstream teams running the PALChain unit/integration tests, which spawn interpreters over fixture programs shaped as `def solution():` that intentionally reference exec/os.system - suppressed by filter_test_and_lint.
  • Security engineers grepping langchain_experimental/pal_chain for os.system or exec( while auditing the CVE - suppressed by filter_code_search.
  • A git commit, tag or PR command whose message quotes the PoC payload while hardening PALChain - suppressed by filter_code_search.
  • pip/poetry/conda operations that pin or remove langchain-experimental and echo the module path - suppressed by filter_pkg_mgmt.
  • Reproduction of CVE-2023-36258 in an authorised lab where the operator includes the CVE identifier in the command - suppressed by filter_research_refs.
  • A production PALChain deployment where the LLM-generated solution() legitimately imports os for filesystem-free arithmetic helpers; rare, and the reason this rule ships as report rather than block.

References