CVE-2024-21513: Langchain-experimental RCE Vulnerability

CVE-2024-21513 Overview

CVE-2024-21513 is an arbitrary code execution vulnerability in the langchain-experimental Python package. Versions from 0.0.15 and before 0.0.21 invoke Python's eval on values retrieved from the database when the server is configured with VectorSQLDatabaseChain. An attacker who can influence the input prompt can execute arbitrary Python code in the process running the chain. The flaw is classified as Improper Control of Generation of Code [CWE-94].

Critical Impact
Attackers with the ability to influence LLM prompts can achieve arbitrary Python code execution on servers running VectorSQLDatabaseChain, enabling file exfiltration and outbound network connections from the host OS.

Affected Products

langchain-experimental versions 0.0.15 through 0.0.20
Applications embedding VectorSQLDatabaseChain from langchain_experimental.sql.vector_sql
LangChain-based LLM services that expose user-controlled prompts to a vector SQL chain

Discovery Timeline

2024-07-15 - CVE-2024-21513 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21513

Vulnerability Analysis

The vulnerable code path lives in libs/experimental/langchain_experimental/sql/vector_sql.py. When VectorSQLDatabaseChain retrieves rows from the backing database, it iterates over the returned values and calls Python's built-in eval on each one. Because the LLM constructs the SQL query from the user prompt, an attacker who influences that prompt can steer the query to return crafted strings that eval will execute.

Exploitation requires the server to be configured with VectorSQLDatabaseChain and the attacker to hold low-privileged access to submit prompts. The scope changes from the LangChain process into the host OS, where post-exploitation activity such as file access, credential theft, and outbound network calls can occur. The EPSS score is 1.864% (77th percentile).

Root Cause

The root cause is unsafe evaluation of untrusted data. eval was used to coerce vector search return values into Python objects without validating that those values were safe literals. Any attacker-controlled string returned from the database is executed as Python code by the interpreter.

Attack Vector

The attack is remote and prompt-driven. An attacker submits a natural-language prompt that causes the LLM to generate a SQL query whose output contains an attacker-supplied Python expression. When the chain post-processes results, eval runs that expression inside the Python process hosting the chain.

python

# Patch excerpt from langchain-experimental commit 7b13292
# libs/experimental/langchain_experimental/sql/vector_sql.py
 from langchain.chains.sql_database.prompt import PROMPT, SQL_PROMPTS
 from langchain.prompts.prompt import PromptTemplate
 from langchain.schema import BaseOutputParser, BasePromptTemplate
-from langchain.schema.base import Embeddings
+from langchain.schema.embeddings import Embeddings
 from langchain.schema.language_model import BaseLanguageModel
 from langchain.tools.sql_database.prompt import QUERY_CHECKER
 from langchain.utilities.sql_database import SQLDatabase

Source: GitHub Commit 7b13292. The fix removes the eval call from the vector SQL DB chain output handling.

Detection Methods for CVE-2024-21513

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running the LangChain service, such as sh, bash, curl, or python -c.
Outbound network connections from the LangChain host to unknown external addresses immediately following prompt processing.
Application logs showing SQL query results containing Python syntax such as __import__, os.system, or subprocess tokens.

Detection Strategies

Inspect deployed dependencies for langchain-experimental versions between 0.0.15 and 0.0.20 using SBOM tooling or pip list.
Instrument the Python process with runtime protection to flag calls into eval, exec, and compile originating from vector_sql.py.
Correlate LLM prompt logs with subsequent process execution and file system events to identify prompt-driven code execution.

Monitoring Recommendations

Log full prompt content, generated SQL, and returned rows for any chain built on VectorSQLDatabaseChain.
Alert on new outbound network flows or new binaries executed under the service account that runs the LangChain application.
Monitor for reads of sensitive files such as /etc/passwd, ~/.aws/credentials, or environment files from the LangChain process.

How to Mitigate CVE-2024-21513

Immediate Actions Required

Upgrade langchain-experimental to version 0.0.21 or later, which removes the eval call from the vector SQL chain.
Audit application code for any use of VectorSQLDatabaseChain and disable the chain until the upgrade is verified in production.
Rotate secrets and credentials accessible to the LangChain service host if exploitation is suspected.

Patch Information

The fix is delivered in commit 7b13292e3544b2f5f2bfb8a27a062ea2b0c34561, which removes the Python eval from the vector SQL DB chain. See the Snyk LangChain Vulnerability Report for advisory details.

Workarounds

Replace VectorSQLDatabaseChain with a chain that does not evaluate returned values, or wrap output parsing with ast.literal_eval behind strict type checks.
Run the LangChain service under a dedicated low-privilege OS account with restricted network egress and file system access.
Apply prompt validation and allowlists to restrict which vector SQL queries can be generated from user input.

bash

# Upgrade to the patched release
pip install --upgrade 'langchain-experimental>=0.0.21'

# Verify the installed version
pip show langchain-experimental | grep -i version