An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the frommathprompt and fromcoloredobject_prompt functions.
"https://github.com/pypa/advisory-database/blob/main/vulns/langchain/PYSEC-2023-146.yaml"