Security
فارسی
All products

langchain-core

PyPI · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsCVE-2025-68664 · GHSA-C67J-W6G6-Q2CMVersion ranges need review. langchain-core PyPI Critical Fix reported
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlistsCVE-2026-44843 · GHSA-PJWX-R37V-7724Version ranges need review. langchain-coreExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 PyPIRed Hat High Fix reported
LangChain has incomplete f-string validation in prompt templatesCVE-2026-40087 · GHSA-926X-3R5X-GFHWVersion ranges need review. langchain-coreMigration Toolkit for Applications 8/redhat-user-workloads/art-images PyPIRed Hat Medium Fix reported
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functionsCVE-2026-34070 · GHSA-QH6H-P6C9-FF54Version ranges need review. langchain-coreOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 PyPIRed Hat High Fix reported
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messagesCVE-2026-26013 · GHSA-2G6R-C272-W58RVersion ranges need review. langchain-coreOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 PyPIRed Hat Low Fix reported
LangChain Vulnerable to Template Injection via Attribute Access in Prompt TemplatesCVE-2025-65106 · GHSA-6QV9-48XG-FC7FVersion ranges need review. langchain-coreOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 PyPIRed Hat High Fix reported
LangChain's XMLOutputParser vulnerable to XML Entity ExpansionCVE-2024-1455 · GHSA-Q84M-RMW3-4382Version ranges need review. langchain-core PyPI Medium Fix reported
langchain-core allows unauthorized users to read arbitrary files from the host file systemCVE-2024-10940 · GHSA-5CHR-FJJV-38QVVersion ranges need review. langchain-core PyPI Medium Fix reported
LangChain directory traversal vulnerabilityCVE-2024-28088 · GHSA-H59X-P739-982CVersion ranges need review. langchain-corelangchain PyPI Low Fix reported