Langchain
5 CVEs across 14 Langchain products. Browse Langchain vulnerabilities, severities, and proof-of-concept exploits.
Langchain products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55443 | Medium | 5.1 | 2026-06-22 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand… |
CVE-2026-48776 | Medium | 4.2 | 2026-06-17 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14… |
CVE-2026-48775 | Medium | 6.8 | 2026-06-16 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and p… |
CVE-2026-44843 | High | 8.2 | 2026-05-26 | LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserial… |
CVE-2026-41488 | Low | 3.1 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_fr… |
CVE-2026-41481 | Medium | 6.5 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.split_text_from_url… |
CVE-2026-40190 | Medium | 5.6 | 2026-04-10 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains… |
CVE-2026-40087 | Medium | 5.3 | 2026-04-09 | LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was inco… |
CVE-2026-34070 | High | 7.5 | 2026-03-31 | LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read f… |
CVE-2026-28277 | Medium | 6.8 | 2026-03-05 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and pr… |
CVE-2026-25750 | High | 8.1 | 2026-03-04 | Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection… |
CVE-2026-27795 | Medium | 4.1 | 2026-02-25 | LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `R… |
CVE-2026-26019 | Medium | 4.1 | 2026-02-11 | LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that rec… |
CVE-2026-26013 | Low | 3.7 | 2026-02-10 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitr… |
CVE-2024-58340 | High | 7.5 | 2026-01-12 | LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/… |
CVE-2025-68665 | High | 8.6 | 2025-12-23 | LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and… |
CVE-2025-68664 | Critical | 9.3 | 2025-12-23 | LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists i… |
CVE-2025-67644 | High | 7.3 | 2025-12-11 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and belo… |
CVE-2025-2828 | Critical | 10.0 | 2025-06-23 | A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_communit… |
CVE-2024-8309 | Critical | 9.8 | 2024-10-29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability c… |
CVE-2024-7774 | Critical | 9.1 | 2024-10-29 | A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files… |
CVE-2024-7042 | Critical | 9.8 | 2024-10-29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leadin… |
CVE-2024-46946 | Critical | 9.8 | 2024-09-19 | langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which… |
CVE-2024-5998 | High | 7.8 | 2024-09-17 | A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to th… |
CVE-2024-21513 | High | 8.5 | 2024-07-15 | Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the databas… |
CVE-2024-38459 | High | 7.8 | 2024-06-16 | langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists bec… |
CVE-2024-3095 | High | 7.7 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability ar… |
CVE-2024-2965 | Medium | 4.7 | 2024-06-06 | A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_site… |
CVE-2024-3571 | High | 8.8 | 2024-04-16 | langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileSt… |
CVE-2024-1455 | Medium | 5.9 | 2024-03-26 | A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multi… |
CVE-2024-28088 | High | 8.1 | 2024-03-04 | LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypa… |
CVE-2024-2057 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/… |
CVE-2024-27444 | Critical | 9.8 | 2024-02-26 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code vi… |
CVE-2024-0243 | High | 8.1 | 2024-02-26 | With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=ur… |
CVE-2023-32786 | High | 7.5 | 2023-10-20 | In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and p… |
CVE-2023-46229 | High | 8.8 | 2023-10-19 | LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. |
CVE-2023-44467 | Critical | 9.8 | 2023-10-09 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code… |
CVE-2023-39631 | Critical | 9.8 | 2023-09-01 | An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library. |
CVE-2023-36281 | Critical | 9.8 | 2023-08-22 | An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a templ… |
CVE-2023-39659 | Critical | 9.8 | 2023-08-15 | An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run c… |
CVE-2023-38896 | Critical | 9.8 | 2023-08-15 | An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_p… |
CVE-2023-38860 | Critical | 9.8 | 2023-08-15 | An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. |
CVE-2023-36095 | Critical | 9.8 | 2023-08-05 | An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions inclu… |
CVE-2023-36189 | High | 7.5 | 2023-07-06 | SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component. |
CVE-2023-36188 | Critical | 9.8 | 2023-07-06 | An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method. |
CVE-2023-36258 | Critical | 9.8 | 2023-07-03 | An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used. |
CVE-2023-34541 | Critical | 9.8 | 2023-06-20 | Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt. |
CVE-2023-34540 | Critical | 9.8 | 2023-06-14 | Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). Thi… |
CVE-2023-29374 | Critical | 9.8 | 2023-04-05 | In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method. |