CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code execution

February 26, 2024 (updated October 27, 2026)

langchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.

References

github.com/advisories/GHSA-v8vj-cv27-hjv8
github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7
github.com/pypa/advisory-database/tree/main/vulns/langchain-experimental/PYSEC-2026-375.yaml
nvd.nist.gov/vuln/detail/CVE-2024-27444
pypi.org/project/langchain-experimental

Code Behaviors & Features

Detect and mitigate CVE-2024-27444 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →