LangChain PALChain: Prompt Injection to RCE (CVE-2023-44467)

What to do

1. Find usage: grep -rn 'PALChain\|langchain_experimental' your code and run pip show langchain-experimental
2. Upgrade langchain-experimental to the latest release (0.0.52 at minimum)
3. Stop passing untrusted or retrieved text into PALChain or any chain that executes LLM-generated code
4. If code execution is a product requirement, run it in a disposable sandbox (container or microVM) with no secrets and no network
5. Treat langchain-experimental as experimental: pin it, review its changelog, and keep it out of internet-facing services

How to check if you are affected or compromised

• Check installed version with pip show langchain-experimental or pip freeze | grep -i langchain
• Search application logs for generated code containing __import__, subprocess, os.system, __subclasses__ or __builtins__
• Look for unexpected child processes or outbound connections from the Python worker hosting the chain

What happened#

On October 9, 2023, CVE-2023-44467 was published for PALChain, a component of langchain_experimental, the package LangChain uses for riskier features. PALChain ("program-aided language model") answers math-style questions by asking the LLM to write Python, then executing that Python. NVD scores the flaw 9.8: an attacker could "bypass the CVE-2023-36258 fix and execute arbitrary code via __import__", because pal_chain/base.py did not prohibit it.

Palo Alto Networks Unit 42, who reported it on September 1, 2023, explained the mechanics. The protection was a blocklist: imports disabled and four functions (system, exec, execfile, eval) refused. A crafted question steered the model into writing code that called the built-in __import__() to load subprocess and run commands. That is prompt injection with a direct path to the host: whoever controls the text controls the code.

The fix, commit 4c97a10 (#11233) on September 29, 2023, added one keyword to the filter list. It did not hold. In February 2024, CVE-2024-27444 showed the same fix could be bypassed via __subclasses__, __builtins__, __globals__, __mro__ and similar attributes; it is fixed in langchain-experimental 0.0.52, also rated 9.8. That makes three CVEs against one blocklist.

Who is affected#

Only applications that install langchain-experimental and run PALChain on input an attacker can influence: chat front-ends, agents that pass along retrieved web pages or documents, or any pipeline where user text reaches the chain. The core langchain package alone is not affected by these two CVEs. The GitHub advisory for CVE-2023-44467 lists no patched version (a data quirk; the fix commit shipped in releases after September 29, 2023), so rely on the later 0.0.52 fix as the floor.

We chose this case for the 2023-10 to 2024-09 window because it is the clearest example of an AI-agent-specific failure: a model's output treated as trusted code. LangChain had other CVEs in the period, including an SSRF in document loaders (CVE-2023-46229), which Unit 42 also covered.

Do you really need to act?#

Most LangChain users can relax: PALChain is a niche, experimental chain, there is no known in-the-wild exploitation, and none of these CVEs are in CISA KEV as of October 21, 2026. Public proof-of-concept prompts exist in Unit 42's write-up.

If you do use PALChain or anything that executes model-written code on untrusted input, act: exploitation needs no credentials, just text. The deeper lesson is that blocklists over a dynamic language like Python keep failing. The pattern recurred: CVE-2024-46946 (September 2024) found code execution through sympy.sympify in LLMSymbolicMathChain in langchain-experimental 0.1.17 through 0.3.0, with no patched version listed.

What to do now#

1. Find usage: grep -rn "PALChain\|langchain_experimental" . and pip show langchain-experimental.
2. Upgrade to the latest langchain-experimental; 0.0.52 is the minimum for the known PALChain bypasses.
3. Do not feed untrusted, user-supplied or retrieved text into code-executing chains.
4. If you need code execution, run it in a throwaway sandbox (container or microVM) with no credentials, no network, and tight resource limits.
5. Keep experimental packages out of internet-facing services.

How to tell if you were hit#

If you log generated code, search it for __import__, subprocess, os.system, __subclasses__ or __builtins__. On the host, look for shells or network tools spawned by the Python worker, unexpected outbound connections, and access to environment variables holding API keys. If exposure is plausible, rotate the LLM provider keys and any other secrets the process could read.

Timeline#

• Sep 1, 2023 — Unit 42 reports the PALChain bypass.
• Sep 29, 2023 — Fix commit #11233 lands.
• Oct 9, 2023 — CVE-2023-44467 published.
• Feb 26, 2024 — Bypass CVE-2024-27444 published; fixed in langchain-experimental 0.0.52.
• Jul 23, 2024 — Unit 42 publishes its analysis.

Vulnerability records

• CVE-2023-44467 · langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code…
• CVE-2024-27444 · langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. NVD — CVE-2023-44467 nvd.nist.gov
2. GitHub Advisory — GHSA-gjjr-63x4-v8cq (CVE-2023-44467) github.com
3. GitHub Advisory — GHSA-v8vj-cv27-hjv8 (CVE-2024-27444) github.com
4. LangChain — fix code injection vuln (#11233) commit github.com
5. Palo Alto Networks Unit 42 — Vulnerabilities in LangChain Gen AI unit42.paloaltonetworks.com
6. GitHub Advisory — GHSA-p2qj-r53j-h3xj (CVE-2024-46946) github.com