dev.langchain4j vulnerabilities

Products

• dev.langchain4j/langchain4j-mariadb 1
• dev.langchain4j/langchain4j-pgvector 1

Latest dev.langchain4j CVEs

Newest publication first

1. CVE-2026-55405 LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

   Published 2026-07-10

   High·CVSS 7.6

   LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string val...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.