id: PYSEC-2023-163
details: An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute
  arbitrary code via the evaluate function in the numexpr library.
aliases:
- CVE-2023-39631
- GHSA-f73w-4m7g-ch9x
modified: '2025-02-20T09:11:38.521949Z'
published: '2023-09-01T16:15:00Z'
references:
- type: EVIDENCE
  url: https://github.com/pydata/numexpr/issues/442
- type: REPORT
  url: https://github.com/pydata/numexpr/issues/442
- type: FIX
  url: https://github.com/pydata/numexpr/issues/442
- type: EVIDENCE
  url: https://github.com/langchain-ai/langchain/issues/8363
- type: REPORT
  url: https://github.com/langchain-ai/langchain/issues/8363
- type: FIX
  url: https://github.com/langchain-ai/langchain/issues/8363
- type: ADVISORY
  url: https://github.com/advisories/GHSA-f73w-4m7g-ch9x
affected:
- package:
    name: numexpr
    ecosystem: PyPI
    purl: pkg:pypi/numexpr
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: '2.8.5'
  versions:
  - 1.1.1
  - '1.2'
  - '1.3'
  - 1.3.1
  - '1.4'
  - 1.4.1
  - 1.4.2
  - '2.0'
  - 2.0.1
  - '2.1'
  - '2.2'
  - 2.2.1
  - 2.2.2
  - '2.3'
  - 2.3-rc1
  - 2.3.1
  - '2.4'
  - 2.4-rc1
  - 2.4-rc2
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - '2.5'
  - 2.5.1
  - 2.5.2
  - 2.6.0
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.6.4
  - 2.6.5
  - 2.6.6
  - 2.6.6.dev0
  - 2.6.7
  - 2.6.8
  - 2.6.9
  - 2.7.0
  - 2.7.1
  - 2.7.2
  - 2.7.3
  - 2.8.0
  - 2.8.1
  - 2.8.3
  - 2.8.4
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H