| Jun 17 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource opeCVE-2026-48776 LangGraphCritical9.1fixed in 0.3.15 | LangGraph | Critical9.1 | 0.3.15 |
| Jun 16 | LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loadersCVE-2026-55443LangChainMedium5.1fixed in 1.3.9 | LangChain | Medium5.1 | 1.3.9 |
| May 13 | LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warningCVE-2026-45134LangChainHigh7.1fixed in 0.3.30 | LangChain | High7.1 | 0.3.30 |
| May 8 | LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlistsCVE-2026-44843LangChainHigh8.2fixed in 0.3.85, 1.3.3 | LangChain | High8.2 | 0.3.85, 1.3.3 |
| Apr 8 | LangChain has incomplete f-string validation in prompt templatesCVE-2026-40087LangChainMedium5.3fixed in 0.3.84, 1.2.28 | LangChain | Medium5.3 | 0.3.84, 1.2.28 |
| Mar 27 | LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functionsCVE-2026-34070LangChainHigh7.5fixed in 1.2.22 | LangChain | High7.5 | 1.2.22 |
| Mar 5 | LangGraph checkpoint loading has unsafe msgpack deserializationCVE-2026-28277LangGraphMedium6.8fixed in 1.0.10 | LangGraph | Medium6.8 | 1.0.10 |
| Feb 25 | LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoaderCVE-2026-27795LangChainMedium4.1fixed in 1.1.18 | LangChain | Medium4.1 | 1.1.18 |
| Feb 11 | @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validationCVE-2026-26019LangChainMedium4.1fixed in 1.1.14 | LangChain | Medium4.1 | 1.1.14 |
| Feb 11 | LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messagesCVE-2026-26013LangChainLow3.7fixed in 1.2.11 | LangChain | Low3.7 | 1.2.11 |
| Dec 232025 | LangChain serialization injection vulnerability enables secret extractionCVE-2025-68665LangChainHigh8.6fixed in 0.3.37, 0.3.80, 1.1.8, 1.2.3 | LangChain | High8.6 | 0.3.37, 0.3.80, 1.1.8, 1.2.3 |
| Dec 232025 | LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsCVE-2025-68664LangChainCritical9.3fixed in 0.3.81, 1.2.5 | LangChain | Critical9.3 | 0.3.81, 1.2.5 |
| Nov 202025 | LangChain Vulnerable to Template Injection via Attribute Access in Prompt TemplatesCVE-2025-65106LangChainHighfixed in 0.3.80, 1.0.7 | LangChain | High | 0.3.80, 1.0.7 |
| Sep 42025 | Langchain Community Vulnerable to XML External Entity (XXE) AttacksCVE-2025-6984LangChainHigh7.5fixed in 0.3.27 | LangChain | High7.5 | 0.3.27 |
| Jun 232025 | LangChain Community SSRF vulnerability exists in RequestsToolkit componentCVE-2025-2828LangChainHigh8.4fixed in 0.0.28 | LangChain | High8.4 | 0.0.28 |
| Mar 202025 | langchain-core allows unauthorized users to read arbitrary files from the host file systemCVE-2024-10940LangChainMedium5.3fixed in 0.1.53, 0.2.43, 0.3.15 | LangChain | Medium5.3 | 0.1.53, 0.2.43, 0.3.15 |
| Oct 292024 | Langchain SQL Injection vulnerabilityCVE-2024-8309LangChainLow4.9fixed in 0.2.0, 0.2.19 | LangChain | Low4.9 | 0.2.0, 0.2.19 |
| Oct 292024 | @langchain/community SQL Injection vulnerabilityCVE-2024-7042LangChainLow4.9fixed in 0.3.3 | LangChain | Low4.9 | 0.3.3 |
| Oct 292024 | Langchain Path Traversal vulnerabilityCVE-2024-7774LangChainMedium6.5fixed in 0.2.19 | LangChain | Medium6.5 | 0.2.19 |
| Sep 192024 | LangChain Experimental Eval Injection vulnerabilityCVE-2024-46946LangChainCritical9.8no fix yet | LangChain | Critical9.8 | No fix yet |
| Sep 172024 | LangChain pickle deserialization of untrusted dataCVE-2024-5998LangChainHigh5.2fixed in 0.2.4 | LangChain | High5.2 | 0.2.4 |
| Jul 152024 | langchain-experimental vulnerable to Arbitrary Code ExecutionCVE-2024-21513LangChainCritical8.5fixed in 0.0.21 | LangChain | Critical8.5 | 0.0.21 |
| Jun 162024 | langchain_experimental Code Execution via Python REPL accessCVE-2024-38459LangChainHigh7.8fixed in 0.0.61 | LangChain | High7.8 | 0.0.61 |
| Jun 62024 | Denial of service in langchain-communityCVE-2024-2965LangChainMedium4.2fixed in 0.2.5 | LangChain | Medium4.2 | 0.2.5 |
| Jun 62024 | Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetrieverCVE-2024-3095LangChainMedium4.8fixed in 0.2.9 | LangChain | Medium4.8 | 0.2.9 |
| Apr 162024 | langchain vulnerable to path traversalCVE-2024-3571LangChainMedium6.5fixed in 0.0.353 | LangChain | Medium6.5 | 0.0.353 |
| Mar 262024 | LangChain's XMLOutputParser vulnerable to XML Entity ExpansionCVE-2024-1455LangChainMedium5.9fixed in 0.1.35 | LangChain | Medium5.9 | 0.1.35 |
| Mar 42024 | LangChain directory traversal vulnerabilityCVE-2024-28088LangChainLowfixed in 0.0.339, 0.1.30 | LangChain | Low | 0.0.339, 0.1.30 |
| Mar 12024 | A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It CVE-2024-2057LangChainCritical9.8no fix yet | LangChain | Critical9.8 | No fix yet |
| Feb 262024 | LangChain Experimental vulnerable to arbitrary code executionCVE-2024-27444LangChainCritical9.8fixed in 0.0.52 | LangChain | Critical9.8 | 0.0.52 |
| Feb 262024 | langchain Server-Side Request Forgery vulnerabilityCVE-2024-0243LangChainLow3.7fixed in 0.1.0 | LangChain | Low3.7 | 0.1.0 |
| Oct 212023 | Langchain Server-Side Request Forgery vulnerabilityCVE-2023-32786LangChainHigh7.5fixed in 0.0.329 | LangChain | High7.5 | 0.0.329 |
| Oct 212023 | Langchain SQL Injection vulnerabilityCVE-2023-32785LangChainCritical9.8fixed in 0.0.247 | LangChain | Critical9.8 | 0.0.247 |
| Oct 192023 | LangChain Server Side Request Forgery vulnerabilityCVE-2023-46229LangChainHigh8.8fixed in 0.0.317 | LangChain | High8.8 | 0.0.317 |
| Oct 92023 | langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec methodCVE-2023-44467LangChainCritical9.8no fix yet | LangChain | Critical9.8 | No fix yet |
| Sep 12023 | Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr libraryCVE-2023-39631LangChainCritical9.8fixed in 0.0.308 | LangChain | Critical9.8 | 0.0.308 |
| Aug 222023 | langchain vulnerable to arbitrary code executionCVE-2023-36281LangChainCritical9.8fixed in 0.0.312 | LangChain | Critical9.8 | 0.0.312 |
| Aug 152023 | LangChain vulnerable to arbitrary code executionCVE-2023-38896LangChainCritical9.8fixed in 0.0.236 | LangChain | Critical9.8 | 0.0.236 |
| Aug 152023 | LangChain vulnerable to arbitrary code executionCVE-2023-38860LangChainCritical9.8fixed in 0.0.247 | LangChain | Critical9.8 | 0.0.247 |
| Aug 152023 | LangChain vulnerable to arbitrary code executionCVE-2023-39659LangChainCritical9.8fixed in 0.0.325 | LangChain | Critical9.8 | 0.0.325 |
| Aug 52023 | langchain Code Injection vulnerabilityCVE-2023-36095LangChainCritical9.8fixed in 0.0.236 | LangChain | Critical9.8 | 0.0.236 |
| Jul 62023 | langchain vulnerable to arbitrary code executionCVE-2023-36188LangChainCritical9.8fixed in 0.0.247 | LangChain | Critical9.8 | 0.0.247 |
| Jul 62023 | langchain SQL Injection vulnerabilityCVE-2023-36189LangChainHigh7.5fixed in 0.0.247 | LangChain | High7.5 | 0.0.247 |
| Jul 32023 | langchain arbitrary code execution vulnerabilityCVE-2023-36258LangChainCritical9.8fixed in 0.0.247 | LangChain | Critical9.8 | 0.0.247 |
| Jun 202023 | Langchain vulnerable to arbitrary code executionCVE-2023-34541LangChainCritical9.8fixed in 0.0.247 | LangChain | Critical9.8 | 0.0.247 |
| Jun 142023 | Langchain OS Command Injection vulnerabilityCVE-2023-34540LangChainCritical9.8fixed in 0.0.225 | LangChain | Critical9.8 | 0.0.225 |
| Apr 52023 | LangChain vulnerable to code injectionCVE-2023-29374LangChainCritical9.8no fix yet | LangChain | Critical9.8 | No fix yet |