--- title: "Security digest: October 9, 2023" url: https://erroneo.us/security/2023-10-09/ description: "October 9, 2023 vulnerability digest: 1 brief (LangChain PALChain: Prompt Injection to RCE…); 1 critical advisory (PyPI). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2023-10-09 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 9, 2023 1 editorial brief and 1 critical advisory. ## Take stock - Check exposure: LangChain PALChain: Prompt Injection to RCE (CVE-2023-44467) . Teams whose Python apps import langchain_experimental and use PALChain or other chains that execute model-generated code on user-influenced input. - PyPI: 1 critical advisory ( langchain-experimental ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Check exposure** [LangChain PALChain: Prompt Injection to RCE (CVE-2023-44467)](https://erroneo.us/security/briefs/langchain-palchain-prompt-injection-rce-cve-2023-44467/index.md): Only apps that feed untrusted text into PALChain (or similar LLM-to-Python chains) are at risk, but for them it is full code execution, and blocklist fixes kept getting bypassed, so remove the pattern rather than trust the patch. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2023-44467](https://erroneo.us/security/cve/CVE-2023-44467/index.md) langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method — PyPI langchain-experimental <= 0.0.14 → no fix --- Source page: https://erroneo.us/security/2023-10-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt