Security researchers at Wiz have discovered a critical remote code execution vulnerability in LangChain, one of the most widely used open-source frameworks for building AI applications. The flaw allows attackers to execute arbitrary code on servers running LangChain-based applications through specially crafted prompt inputs.
The vulnerability, rated 9.8 on the CVSS scale, affects all versions of LangChain prior to 0.3.15. The maintainers have released an emergency patch and are urging all users to update immediately.
Wiz estimates that over 40,000 production applications built on LangChain may be vulnerable. Organizations using the framework should audit their deployments and apply the patch as a top priority.
