Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2023-29374: Researchers formalized the "Poison Once, Exploit Forever" attack class in April 2026 — and it is arguably the most structurally dangerous vulnerability in production AI systems today. Unlike a standard prompt injection that resets when the conversation…
Post summary
The text references CVE‑2023‑29374 as a dangerously structural vulnerability in AI systems, but offers no PoC, exploitation evidence, or technical specifics.
CVE-2023-29374 (LangChain's llmmath chain) and CVE-2023-32786 (LangChain APIChain) both exploit this pattern — injecting adversarial text through tool outputs that the LLM then faithfully executes. The persistence is session-scoped, but the damage can include credential…
Post summary
Two LangChain vulnerabilities (CVE‑2023‑29374 and CVE‑2023‑32786) allow attackers to inject adversarial text via tool outputs, which the LLM then executes; the effect is session‑scoped with potential credential theft.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langchain | langchain | - | - | - |