Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Linked library records
Independent products or attack paths are assessed separately. A combined report receives no aggregate score.
Original report record: LLMSmith: RCE Vulnerabilities in LLM-Integrated Applications.
The LLMSmith researchers list LangChain 0.0.232 create_csv_agent, create_spark_dataframe_agent, and create_pandas_dataframe_agent in Table 5 as a prompt-triggered RCE path that executes LLM-generated code without checking it. Their validation used a controlled research configuration; they did not establish a named production victim for this specific API. Three dataframe agent API rows share one CVE and unchecked execution mechanism.
ASSESSED SYSTEM
Representative LLM-integrated application using LangChain 0.0.232 create_csv_agent, create_spark_dataframe_agent, and create_pandas_dataframe_agent in the tested version, with model-generated code reaching the described framework execution API.
OUT OF SCOPE
The assessed path is LangChain 0.0.232 create_csv_agent, create_spark_dataframe_agent, and create_pandas_dataframe_agent (CVE-2023-39659) in the version tested by the paper. Other framework APIs, later fixes, the researchers' anonymous apps, and in-the-wild attacker exploitation are outside scope.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — Q2 autonomous multi-step behavior is not required by this finding; Q3 applies because the LLM-backed application invokes a framework code tool on generated output. Tier 2: Tier 2 representative public-facing service scenario; the original source does not establish every operator tier.
Documented attack or failure path
- A user prompt reached an LLM-integrated application using the specified framework API.
- The LLM generated code that the framework API passed to execution without an effective host-scope check.
- The researchers validated code execution in a controlled copy or test configuration; no named victim incident is inferred.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- No positive containment control for this pre-fix tested path is established by the paper. Other LLMSmith test applications may have blocked attacks, but are separate boundaries.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.88 (midpoint 0.44), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.12 | The model-directed code path could execute beyond the user task boundary with no effective host restriction, matching the Cn-1 0.00 anchor. | LLMSmith Table 5 identifies LangChain 0.0.232 create_csv_agent, create_spark_dataframe_agent, and create_pandas_dataframe_agent as prompt-triggered code execution without checking the generated code.source: primary report |
Unknown, not N/A: 25 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.25 | Representative activity level for the documented bounded AI path; deployment-specific autonomy was not measured. |
| AsAttack Surface Exposure | 0.75w 0.35 | Representative exposure of the documented entry path; this is a scenario assumption and not a census of all operators. |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph or DGC is published, so framework worst-case Cp default applies.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.50w 0.20 | The paper does not establish deployed repair time or a patch for this exact tested API. The remediation score is an explicit representative comparison assumption; actual repair feasibility is unknown, not measured recovery time. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance identifies the affected path but supplies no operator assessment pack, signed configuration inventory, or repeated metric battery. |
| Ec — Public evaluation coverage | 0.03 | coverage 0.04 (1 of 26 applicable sub-metrics) × independence 0.80 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2023-08-15; age 1160 days on the workpaper reference date. Components: T_calendar 0.00 · C_monitor 0.60. Binding term: T_calendar. Evidence reference is 2026-10-18, 1160 days after earliest substantive public evidence (2023-08-15). C_monitor uses the conservative Tier 2 public-evidence default because usable monitoring-coverage evidence is unavailable; it does not assert no deployment telemetry. No C_event cap is asserted from research or an advisory without a dated victim incident. No generic C_evidence cap is assigned from missing public inputs. Indicative ERS uses normalized ACI = 1.00 for comparison only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.01 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.0 midpoint, interval 1.1–6.9; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
LLMSmith Section 5.1 Table 5 reports an unversioned CVSS number of 9.8 for this path. The paper provides no vector, CVSS version, or separate scoring authority; no complete published comparison entry was transcribed.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
WHAT THIS CASE TEACHES
LangChain 0.0.232 create_csv_agent, create_spark_dataframe_agent, and create_pandas_dataframe_agent is one bounded prompt-to-code research path. Three dataframe agent API rows share one CVE and unchecked execution mechanism.
Sources: Original LLMSmith study, Table 2 and Table 5 (revision 2025-02-27) · Primary CVE record — CVE-2023-39659