Skip to content
OpenAdvisories

Package · npm

@langchain/community

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.1
    CVE-2026-27795

    LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

    LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the un…

    langchain-ai langchainjs @langchain/community npm
  • Medium 4.1
    CVE-2026-26019

    @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

    LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intend…

    langchain-ai langchainjs @langchain/community npm
  • Medium 4.9
    CVE-2024-7042

    Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection

    A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, de…

    langchain-ai langchain-ai/langchainjs @langchain/community npm