Latest vulnerabilities for vendor "langchain"

Where

Sort:

Software

langchain

langchain langchain

langchain langchain core python

langchain langchain community node.js

langchain langchain-text-splitters

langchain community

langchain langchain experimental python

langchain langchain-openai

langchain langchain.js

langchain langchain\/core node.js

langchain langgraph

langchain langgraph-checkpoint-sqlite python

langchain langsmith kubernetes

langchain-ai langchain

pip/langchain-coreLangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists

Risk 57

Severity

8.2

First published (updated )

CVE-2026-44843

pypi/langchain-openaiangchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

Risk 17

Severity

3.1

First published (updated )

CVE-2026-41488

pypi/langchain-text-splittersLangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Risk 37

Severity

6.5

First published (updated )

CVE-2026-41481

pip/langchain-coreLangChain has incomplete f-string validation in prompt templates

Risk 27

Severity

5.3

First published (updated )

CVE-2026-40087

pip/langchain-coreLangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

Risk 43

Severity

7.5

First published (updated )

CVE-2026-34070

pypi/langgraphLangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

Risk 49

Severity

7.2

EPSS

0.03%

First published (updated )

CVE-2026-28277

helm/langchain-ai/helmLangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl

Risk 64

Severity

8.5

First published (updated )

CVE-2026-25750

npm/@langchain/communityLangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

Risk 30

Severity

7.4

EPSS

0.03%

First published (updated )

CVE-2026-27795

npm/@langchain/community@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

Risk 16

Severity

4.1

EPSS

0.01%

First published (updated )

CVE-2026-26019

pypi/langchainLangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

Risk 15

Severity

3.7

EPSS

0.01%

First published (updated )

CVE-2026-26013

pypi/langchainLangChain <= 0.3.1 MRKLOutputParser ReDoS

Risk 47

Severity

8.7

First published (updated )

CVE-2024-58340

npm/langchainLangChain serialization injection vulnerability enables secret extraction

Risk 66

Severity

9.1

First published (updated )

CVE-2025-68665

pip/langchain-coreLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

Risk 70

Severity

9.3

Exploited

First published (updated )

CVE-2025-68664

pip/langgraph-checkpoint-sqliteLangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method

Risk 69

Severity

7.8

First published (updated )

CVE-2025-67644

Langchain langgraph-checkpoint-sqliteSQL Injection in langchain-ai/langchain

Risk 47

Severity

7.3

First published (updated )

CVE-2025-8709

Langchain langchain-text-splittersXXE Vulnerability in langchain-ai/langchain

Risk 43

Severity

7.5

First published (updated )

CVE-2025-6985

Langchain ChatGLM-WebuiInsecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view an…

Risk 86

Severity

9.8

First published (updated )

CVE-2025-45150

Langchain langchain-aiCode Injection

Risk 86

Severity

9.8

First published (updated )

CVE-2025-46059

langchain-ai langchainSSRF Vulnerability in RequestsToolkit in langchain-ai/langchain

Risk 91

Severity

First published (updated )

CVE-2025-2828

pip/langchain-communitySQL Injection in langchain-ai/langchain

Risk 89

Severity

9.8

First published (updated )

CVE-2024-8309

npm/@langchain/communityPrompt Injection in langchain-ai/langchainjs Leading to SQL Injection

Risk 89

Severity

9.8

First published (updated )

CVE-2024-7042

npm/langchainPath Traversal in langchain-ai/langchainjs

Risk 69

Severity

9.1

First published (updated )

CVE-2024-7774

pip/langchain-experimentalInput Validation

Risk 89

Severity

9.8

First published (updated )

CVE-2024-46946

pip/langchain-communityDeserialization of Untrusted Data in langchain-ai/langchain

Risk 71

Severity

7.8

First published (updated )

CVE-2024-5998

pip/langchain-experimentalCode Injection

Risk 76

Severity

8.6

First published (updated )

CVE-2024-21513

pip/langchain-experimentallangchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL…

Risk 71

Severity

7.8

First published (updated )

CVE-2024-38459

pip/langchainDenial-of-Service in langchain-community SitemapLoader

Risk 29

Severity

4.7

First published (updated )

CVE-2024-2965

pip/langchain-communitySSRF in Langchain Web Research Retriever in langchain-ai/langchain

Risk 45

Severity

7.7

First published (updated )

CVE-2024-3095

pip/langchainPath Traversal in langchain-ai/langchain

Risk 58

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2024-3571

pip/langchain-coreBillion Laughs Attack leading to DoS in langchain-ai/langchain

Risk 37

Severity

5.9

First published (updated )

CVE-2024-1455

Trending

Vendor Risk Score

Software

pip/langchain-coreLangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists

pypi/langchain-openaiangchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

pypi/langchain-text-splittersLangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

pip/langchain-coreLangChain has incomplete f-string validation in prompt templates

pip/langchain-coreLangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

Don't miss critical vulnerabilities

pypi/langgraphLangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

helm/langchain-ai/helmLangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl

npm/@langchain/communityLangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

npm/@langchain/community@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

pypi/langchainLangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

Don't miss critical vulnerabilities

pypi/langchainLangChain <= 0.3.1 MRKLOutputParser ReDoS

npm/langchainLangChain serialization injection vulnerability enables secret extraction

pip/langchain-coreLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

pip/langgraph-checkpoint-sqliteLangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method

Langchain langgraph-checkpoint-sqliteSQL Injection in langchain-ai/langchain

Don't miss critical vulnerabilities

Langchain langchain-text-splittersXXE Vulnerability in langchain-ai/langchain

Langchain ChatGLM-WebuiInsecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view an…

Langchain langchain-aiCode Injection

langchain-ai langchainSSRF Vulnerability in RequestsToolkit in langchain-ai/langchain

pip/langchain-communitySQL Injection in langchain-ai/langchain

Don't miss critical vulnerabilities

npm/@langchain/communityPrompt Injection in langchain-ai/langchainjs Leading to SQL Injection

npm/langchainPath Traversal in langchain-ai/langchainjs

pip/langchain-experimentalInput Validation

pip/langchain-communityDeserialization of Untrusted Data in langchain-ai/langchain

pip/langchain-experimentalCode Injection

Don't miss critical vulnerabilities

pip/langchain-experimentallangchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL…

pip/langchainDenial-of-Service in langchain-community SitemapLoader

pip/langchain-communitySSRF in Langchain Web Research Retriever in langchain-ai/langchain

pip/langchainPath Traversal in langchain-ai/langchain

pip/langchain-coreBillion Laughs Attack leading to DoS in langchain-ai/langchain

Don't miss critical vulnerabilities

Company

Resources

Contact