LangChain LLMMathChain prompt-injection RCE via Python exec
Date: 2023-04
Affected: langchain-ai/langchain <= 0.0.131 (fixed 0.0.142)
Attack vector: prompt-injection
Category: real-world
Severity: Critical
CVE: CVE-2023-29374
CVE-2023-32785
CVE-2023-32786
CVE-2023-34541
CVE-2023-36095
CVE-2023-36188
CVE-2023-36189
CVE-2023-36258
CVE-2023-38860
CVE-2023-38896
CVE-2023-44467
CVE-2023-46229
CVE-2024-0243
CVE-2024-21513
CVE-2024-27444
CVE-2024-28088
CVE-2024-2965
CVE-2024-3095
CVE-2024-3571
CVE-2024-38459
CVE-2024-46946
CVE-2024-58340
CVE-2024-5998
CVE-2024-8309
CVE-2026-55443
CWE: CWE-1333
CWE-20
CWE-22
CWE-276
CWE-31
CWE-400
CWE-502
CWE-59
CWE-674
CWE-74
CWE-749
CWE-89
CWE-918
CWE-94
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method. The chain uses insecure exec/eval on LLM-generated math expressions. Disclosed by the NVIDIA AI Red Team; fixed in 0.0.142.

Impact: Remote code execution on agent host; environment variable exfiltration; reverse shell establishment; full host compromise

Mitigations:
Disable code execution tools in production unless strictly required
Input validation before any tool invocation — do not pass unvalidated content to execution tools
Least-privilege principle — agents should not have host execution capabilities
Run code execution in sandboxed environments with no network access (containers, gVisor)
Run eval profiles: evals/garak/ASI05_code_execution.yaml — threshold 0%

Architectural layers (MAESTRO):