---
title: "LangChain PALChain: Prompt Injection to RCE (CVE-2023-44467)"
url: https://erroneo.us/security/briefs/langchain-palchain-prompt-injection-rce-cve-2023-44467/
description: "LangChain PALChain ran LLM-written Python; a crafted prompt could run commands. Bypassed again in CVE-2024-27444. Upgrade, and stop executing model code."
type: security-brief
section: "Security Digest"
date_published: 2023-10-09
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-44467", "CVE-2024-27444"]
severity: "critical"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# LangChain PALChain: Prompt Injection to RCE (CVE-2023-44467)

**Verdict: Check exposure.** Only apps that feed untrusted text into PALChain (or similar LLM-to-Python chains) are at risk, but for them it is full code execution, and blocklist fixes kept getting bypassed, so remove the pattern rather than trust the patch.

- **Who must act:** Teams whose Python apps import langchain_experimental and use PALChain or other chains that execute model-generated code on user-influenced input.
- **Who can relax:** LangChain users who never install langchain-experimental or never use its code-executing chains, and users of other LLM frameworks without eval-style features.
- **Affected:** langchain-experimental PALChain before the Sept 29, 2023 fix (LangChain before 0.0.306, CVE-2023-44467); langchain-experimental before 0.0.52 (CVE-2024-27444 bypass)
- **Fixed:** langchain-experimental 0.0.52 (CVE-2024-27444); Latest langchain-experimental release recommended
- **CVEs:** CVE-2023-44467, CVE-2024-27444
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Find usage: grep -rn 'PALChain\|langchain_experimental' your code and run pip show langchain-experimental
2. Upgrade langchain-experimental to the latest release (0.0.52 at minimum)
3. Stop passing untrusted or retrieved text into PALChain or any chain that executes LLM-generated code
4. If code execution is a product requirement, run it in a disposable sandbox (container or microVM) with no secrets and no network
5. Treat langchain-experimental as experimental: pin it, review its changelog, and keep it out of internet-facing services

### How to check if you are affected

- Check installed version with pip show langchain-experimental or pip freeze | grep -i langchain
- Search application logs for generated code containing __import__, subprocess, os.system, __subclasses__ or __builtins__
- Look for unexpected child processes or outbound connections from the Python worker hosting the chain

## What happened

On October 9, 2023, CVE-2023-44467 was published for PALChain, a component of `langchain_experimental`, the package LangChain uses for riskier features. PALChain ("program-aided language model") answers math-style questions by asking the LLM to write Python, then executing that Python. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-44467) scores the flaw 9.8: an attacker could "bypass the CVE-2023-36258 fix and execute arbitrary code via `__import__`", because `pal_chain/base.py` did not prohibit it.

[Palo Alto Networks Unit 42](https://unit42.paloaltonetworks.com/langchain-vulnerabilities/), who reported it on September 1, 2023, explained the mechanics. The protection was a blocklist: imports disabled and four functions (`system`, `exec`, `execfile`, `eval`) refused. A crafted question steered the model into writing code that called the built-in `__import__()` to load `subprocess` and run commands. That is prompt injection with a direct path to the host: whoever controls the text controls the code.

The fix, [commit 4c97a10 (#11233)](https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483) on September 29, 2023, added one keyword to the filter list. It did not hold. In February 2024, [CVE-2024-27444](https://github.com/advisories/GHSA-v8vj-cv27-hjv8) showed the same fix could be bypassed via `__subclasses__`, `__builtins__`, `__globals__`, `__mro__` and similar attributes; it is fixed in langchain-experimental 0.0.52, also rated 9.8. That makes three CVEs against one blocklist.

## Who is affected

Only applications that install `langchain-experimental` and run PALChain on input an attacker can influence: chat front-ends, agents that pass along retrieved web pages or documents, or any pipeline where user text reaches the chain. The core `langchain` package alone is not affected by these two CVEs. The [GitHub advisory for CVE-2023-44467](https://github.com/advisories/GHSA-gjjr-63x4-v8cq) lists no patched version (a data quirk; the fix commit shipped in releases after September 29, 2023), so rely on the later 0.0.52 fix as the floor.

We chose this case for the 2023-10 to 2024-09 window because it is the clearest example of an AI-agent-specific failure: a model's output treated as trusted code. LangChain had other CVEs in the period, including an SSRF in document loaders (CVE-2023-46229), which Unit 42 also covered.

## Do you really need to act?

Most LangChain users can relax: PALChain is a niche, experimental chain, there is no known in-the-wild exploitation, and none of these CVEs are in CISA KEV as of October 21, 2026. Public proof-of-concept prompts exist in Unit 42's write-up.

If you do use PALChain or anything that executes model-written code on untrusted input, act: exploitation needs no credentials, just text. The deeper lesson is that blocklists over a dynamic language like Python keep failing. The pattern recurred: [CVE-2024-46946](https://github.com/advisories/GHSA-p2qj-r53j-h3xj) (September 2024) found code execution through `sympy.sympify` in LLMSymbolicMathChain in langchain-experimental 0.1.17 through 0.3.0, with no patched version listed.

## What to do now

1. Find usage: `grep -rn "PALChain\|langchain_experimental" .` and `pip show langchain-experimental`.
2. Upgrade to the latest langchain-experimental; 0.0.52 is the minimum for the known PALChain bypasses.
3. Do not feed untrusted, user-supplied or retrieved text into code-executing chains.
4. If you need code execution, run it in a throwaway sandbox (container or microVM) with no credentials, no network, and tight resource limits.
5. Keep experimental packages out of internet-facing services.

## How to tell if you were hit

If you log generated code, search it for `__import__`, `subprocess`, `os.system`, `__subclasses__` or `__builtins__`. On the host, look for shells or network tools spawned by the Python worker, unexpected outbound connections, and access to environment variables holding API keys. If exposure is plausible, rotate the LLM provider keys and any other secrets the process could read.

## Timeline

- Sep 1, 2023 — Unit 42 reports the PALChain bypass.
- Sep 29, 2023 — Fix commit #11233 lands.
- Oct 9, 2023 — CVE-2023-44467 published.
- Feb 26, 2024 — Bypass CVE-2024-27444 published; fixed in langchain-experimental 0.0.52.
- Jul 23, 2024 — Unit 42 publishes its analysis.

## Sources

1. [NVD — CVE-2023-44467](https://nvd.nist.gov/vuln/detail/CVE-2023-44467)
2. [GitHub Advisory — GHSA-gjjr-63x4-v8cq (CVE-2023-44467)](https://github.com/advisories/GHSA-gjjr-63x4-v8cq)
3. [GitHub Advisory — GHSA-v8vj-cv27-hjv8 (CVE-2024-27444)](https://github.com/advisories/GHSA-v8vj-cv27-hjv8)
4. [LangChain — fix code injection vuln (#11233) commit](https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483)
5. [Palo Alto Networks Unit 42 — Vulnerabilities in LangChain Gen AI](https://unit42.paloaltonetworks.com/langchain-vulnerabilities/)
6. [GitHub Advisory — GHSA-p2qj-r53j-h3xj (CVE-2024-46946)](https://github.com/advisories/GHSA-p2qj-r53j-h3xj)

---
Source page: https://erroneo.us/security/briefs/langchain-palchain-prompt-injection-rce-cve-2023-44467/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt