@langchain vulnerabilities

Products

• langchain 28
• langchain experimental 5
• langchain core 4
• langchain-experimental 4
• @langchain/community 3
• langchain_community 3
• langchain.js 2
• langsmith 2
• @langchain/core 1
• @langchain/langgraph-checkpoint-mongodb 1
• @langchain/langgraph-checkpoint-redis 1
• langchain-openai 1
• langchain-text-splitters 1
• langchaincore 1
• langgraph 1
• langgraph-checkpoint 1
• langgraph-checkpoint-sqlite 1
• langgraph-sdk 1
• mongodb 1
• redis 1

Latest @langchain CVEs

Newest publication first · page 1 of 3

1. CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

   Published 2026-10-06

   Medium·CVSS 6.0 EPSS 0.46%

   LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition...

2. CVE-2026-105799 LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

   Published 2026-10-06

   Low·CVSS 2.3 EPSS 0.28%

   LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the gen...

3. CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

   Published 2026-08-04

   Medium·CVSS 6.7 EPSS 0.31%

   @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are...

4. CVE-2026-55443 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

   Published 2026-06-22

   Medium·CVSS 5.5 EPSS 0.21%

   LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include...

5. CVE-2026-48776 LangGraph SDK has unsafe URL path construction

   Published 2026-06-16

   Critical·CVSS 9.1 EPSS 0.22%

   LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request pa...

6. CVE-2026-48775 LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

   Published 2026-06-16

   Medium·CVSS 6.8 EPSS 0.23%

   LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone...

7. CVE-2026-44843 LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists

   Published 2026-05-26

   High·CVSS 8.2 EPSS 0.41%

   LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths m...

8. CVE-2026-41488 angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

   Published 2026-04-24

   Low·CVSS 3.1 EPSS 0.16%

   LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network oper...

9. CVE-2026-41481 LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

   Published 2026-04-24

   Medium·CVSS 6.5 EPSS 0.26%

   LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects ena...

10. CVE-2026-40190 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

    Published 2026-04-10

    Critical·CVSS 9.8 EPSS 0.33%

    LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function onl...

11. CVE-2026-40087 LangChain has incomplete f-string validation in prompt templates

    Published 2026-04-09

    Medium·CVSS 5.3 EPSS 0.27%

    LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforc...

12. CVE-2026-34070 LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

    Published 2026-03-31

    High·CVSS 7.5 EPSS 1.4%

    LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path inj...

13. CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

    Published 2026-03-05

    High·CVSS 7.2 EPSS 5.5%

    LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization....

14. CVE-2026-25750 LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl

    Published 2026-03-04

    High·CVSS 8.5 EPSS 0.35%

    Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts through stolen authentic...

15. CVE-2026-27795 LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

    Published 2026-02-25

    High·CVSS 7.4 EPSS 0.25%

    LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow...

16. CVE-2026-27022 RediSearch Query Injection in @langchain/langgraph-checkpoint-redis

    Published 2026-02-20

    Medium·CVSS 6.5 EPSS 4.0%

    @langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch q...

17. CVE-2026-26019 @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

    Published 2026-02-11

    Medium·CVSS 4.1 EPSS 0.39%

    LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawli...

18. CVE-2026-26013 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

    Published 2026-02-10

    Low·CVSS 3.7 EPSS 0.42%

    LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to t...

19. CVE-2024-58340 LangChain <= 0.3.1 MRKLOutputParser ReDoS

    Published 2026-01-12

    High·CVSS 8.7 EPSS 0.48%

    LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extrac...

20. CVE-2025-68665 LangChain serialization injection vulnerability enables secret extraction

    Published 2025-12-23

    Critical·CVSS 9.1 EPSS 0.79%

    LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ify...

21. CVE-2025-68664 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

    Published 2025-12-23

    High·CVSS 8.2 EPSS 42.9% Public exploit

    LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing fre...

22. CVE-2025-67644 LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method

    Published 2025-12-10

    High·CVSS 7.8 EPSS 2.5%

    LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL qu...

23. CVE-2025-2828 SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain

    Published 2025-06-23

    Critical·CVSS 10.0 EPSS 21.0%

    A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vulnerability occurs bec...

24. CVE-2024-8309 SQL Injection in langchain-ai/langchain

    Published 2024-10-29

    Critical·CVSS 9.8 EPSS 13.7%

    A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in m...

25. CVE-2024-7042 Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection

    Published 2024-10-29

    Critical·CVSS 9.8 EPSS 0.31%

    A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS)...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.