{
 "id": "AIR-2024-0149",
 "slug": "cve-2024-21513-langchain-experimental-vulnerable-to-arbitrar",
 "title": "CVE-2024-21513: langchain-experimental vulnerable to arbitrary code execution",
 "summary": "Certain versions of langchain-experimental are vulnerable to arbitrary code execution when retrieving database values due to unsafe eval usage. Attackers can exploit this if they control input prompts on servers configured with VectorSQLDatabaseChain.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "langchain-experimental"
 ],
 "incident_date": "2024-07-15",
 "incident_date_precision": "day",
 "first_reported": "2024-07-15",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-cgcg-p68q-3w7v",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2024-21513: langchain-experimental vulnerable to Arbitrary Code Execution",
   "published_at": "2024-07-15"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21513",
   "publisher": "NVD",
   "title": "CVE-2024-21513: Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when…",
   "published_at": "2024-07-15"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2024-21513",
  "code-execution"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}