Langchain vulnerabilities

Products

• Langchain 28
• Experimental 5
• Core 4
• Langchain-experimental 4
• Community 3
• Langchain.js 2
• Langsmith 2

Newest

• langchain langgraph-sdk, langchain-ai, langchain-ai langchain-sdk +2 more LangGraph SDK has unsafe URL path construction CVE-2026-48776 Fix available 4.2 MediumJune 16, 2026
• langchain-ai langgraph, langchain langgraph-checkpoint, langchain-ai langraph-checkpoint +2 more LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading CVE-2026-48775 Fix available 6.8 MediumJune 16, 2026
• langchain, langchain-ai langchain-anthropic +1 more LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders CVE-2026-55443 Fix available 5.1 MediumJune 16, 2026
• langchain LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists CVE-2026-44843 Fix available 8.2 HighMay 8, 2026
• langchain langchain-openai angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding CVE-2026-41488 Fix available 3.1 LowApril 16, 2026
• langchain langchain-text-splitters, red hat migration toolkit for applications 8, openshift lightspeed +2 more +4 more LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass CVE-2026-41481 Fix available 6.5 MediumApril 16, 2026
• langchain langsmith, langchain-ai langsmith-sdk +1 more LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()` CVE-2026-40190 Fix available 5.6 MediumApril 10, 2026
• langchain-ai langchain, langchain core +1 more LangChain has incomplete f-string validation in prompt templates CVE-2026-40087 Fix available 5.3 MediumApril 8, 2026
• langchain core, langchain-ai langchain, red hat openshift lightspeed +4 more +6 more LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions CVE-2026-34070 Public exploitFix available 7.5 HighMarch 27, 2026
• langchain langgraph LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading CVE-2026-28277 Fix available 6.8 MediumMarch 5, 2026
• helm, langchain langsmith +1 more LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl CVE-2026-25750 8.5 HighMarch 4, 2026
• langchain community, langchain-ai langchainjs +1 more LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader CVE-2026-27795 Fix available 4.1 MediumFebruary 25, 2026
• langchain community, langchain-ai langchainjs +1 more @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation CVE-2026-26019 Fix available 4.1 MediumFebruary 11, 2026
• langchain-ai langchain, langchain core +1 more LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages CVE-2026-26013 Fix available 3.7 LowFebruary 10, 2026
• langchain LangChain <= 0.3.1 MRKLOutputParser ReDoS CVE-2024-58340 Fix available 8.7 HighJanuary 12, 2026
• langchain langchain.js, langchain\/core, langchain-ai langchainjs +2 more LangChain serialization injection vulnerability enables secret extraction CVE-2025-68665 Fix available 8.6 HighDecember 23, 2025
• langchain-ai langchain, langchain core +1 more LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs CVE-2025-68664 Public exploitFix available EPSS 42.9% 9.3 CriticalDecember 23, 2025
• langchain-ai langgraph, langchain langgraph-checkpoint-sqlite +1 more LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method CVE-2025-67644 Public exploitFix available 7.3 HighDecember 10, 2025
• langchain, langchain-ai langchain-ai/langchain +1 more SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain CVE-2025-2828 Fix available EPSS 21.0% 8.4 HighJune 23, 2025
• langchain, langchain-ai langchain-ai/langchain +1 more SQL Injection in langchain-ai/langchain CVE-2024-8309 Public exploitFix available EPSS 13.7% 4.9 MediumOctober 29, 2024
• langchain, langchain-ai langchain-ai/langchainjs, langchainjs +2 more Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection CVE-2024-7042 Fix available 4.9 MediumOctober 29, 2024
• langchain-ai langchain-ai/langchainjs, langchain langchain.js, langchain-ai langchain-ai\/langchainjs +2 more Path Traversal in langchain-ai/langchainjs CVE-2024-7774 Fix available 6.5 MediumOctober 29, 2024
• langchain experimental, langchain-experimental +1 more LangChain Experimental Eval Injection vulnerability CVE-2024-46946 9.8 CriticalSeptember 19, 2024
• langchain, langchain-ai langchain-ai/langchain +1 more Deserialization of Untrusted Data in langchain-ai/langchain CVE-2024-5998 Fix available 5.2 MediumSeptember 17, 2024
• langchain langchain-experimental, experimental +1 more langchain-experimental vulnerable to Arbitrary Code Execution CVE-2024-21513 Public exploitFix available 8.5 HighJuly 15, 2024
• langchain experimental, langchain-experimental +1 more langchain_experimental Code Execution via Python REPL access CVE-2024-38459 Fix available 7.8 HighJune 16, 2024
• langchain, langchain-ai langchain-ai/langchain +1 more Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain CVE-2024-2965 Fix available 4.2 MediumJune 6, 2024
• langchain, langchain-ai langchain-ai/langchain +1 more SSRF in Langchain Web Research Retriever in langchain-ai/langchain CVE-2024-3095 Fix available 4.8 MediumJune 6, 2024
• langchain, langchain-ai langchain-ai/langchain +1 more Path Traversal in langchain-ai/langchain CVE-2024-3571 Fix available 6.5 MediumApril 16, 2024
• langchain, langchain-ai langchain-ai/langchain, langchain-ai\/langchain +2 more Billion Laughs Attack leading to DoS in langchain-ai/langchain CVE-2024-1455 Fix available 5.9 MediumMarch 26, 2024
• langchain LangChain directory traversal vulnerability CVE-2024-28088 Public exploitFix available 8.1 HighMarch 3, 2024
• langchain, langchain community +1 more LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery CVE-2024-2057 6.3 MediumMarch 1, 2024
• langchain experimental, langchain-experimental +1 more LangChain Experimental vulnerable to arbitrary code execution CVE-2024-27444 Fix available 9.8 CriticalFebruary 26, 2024
• langchain, langchain-ai langchain-ai/langchain, langchain-ai\/langchain +2 more Server-side Request Forgery In Recursive URL Loader CVE-2024-0243 Fix available 3.7 LowFebruary 24, 2024
• langchain Langchain Server-Side Request Forgery vulnerability CVE-2023-32786 Fix available 7.5 HighOctober 20, 2023
• langchain LangChain Server Side Request Forgery vulnerability CVE-2023-46229 Public exploitFix available EPSS 47.6% 8.8 HighOctober 19, 2023
• langchain experimental langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method CVE-2023-44467 Fix available 9.8 CriticalOctober 9, 2023
• langchain Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library CVE-2023-39631 Fix available 9.8 CriticalSeptember 1, 2023
• langchain langchain vulnerable to arbitrary code execution CVE-2023-36281 Public exploitFix available 9.8 CriticalAugust 22, 2023
• langchain LangChain vulnerable to arbitrary code execution CVE-2023-39659 Fix available 9.8 CriticalAugust 15, 2023
• langchain LangChain vulnerable to arbitrary code execution CVE-2023-38896 Fix available 9.8 CriticalAugust 15, 2023
• langchain LangChain vulnerable to arbitrary code execution CVE-2023-38860 Fix available 9.8 CriticalAugust 15, 2023
• langchain langchain Code Injection vulnerability CVE-2023-36095 Fix available 9.8 CriticalAugust 5, 2023
• langchain langchain SQL Injection vulnerability CVE-2023-36189 Fix available 7.5 HighJuly 6, 2023
• langchain langchain vulnerable to arbitrary code execution CVE-2023-36188 Fix available 9.8 CriticalJuly 6, 2023
• langchain langchain arbitrary code execution vulnerability CVE-2023-36258 Fix available 9.8 CriticalJuly 3, 2023
• langchain Langchain vulnerable to arbitrary code execution CVE-2023-34541 Fix available 9.8 CriticalJune 20, 2023
• langchain Langchain OS Command Injection vulnerability CVE-2023-34540 Fix available 9.8 CriticalJune 14, 2023
• langchain LangChain vulnerable to code injection CVE-2023-29374 Fix available EPSS 39.7% 9.8 CriticalApril 5, 2023