Resolution for critical vulnerability: CVE-2024-46946

[dzubke]

I'm using langchain in my job and a recent critical vulnerability CVE-2024-46946 is creating an issue in our deployments:

langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde4 (2023-10-05).

It seems to be up to the latest version of langchain. Are there any updates on when this will be resolved?

[dzubke]

And just for emphasis, we have some of our first production deployments of applications on our platform going on right now, and we are blocked by this vulnerability. And since it's such a broad range of versions, we can't downgrade our way around it.

The vulnerability is for langchain_experimental is perhaps there is a way we can not install that specific library.

@hwchase17 @vbarda - any guidance you have here is appreciated! 🙏

[dzubke]

This PR #26783 resolves this issue. Thank you @mercyspirit !