Skip to content
OpenAdvisories

Package · PyPI

langchain-community

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.5
    CVE-2025-6984

    Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain

    The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without d…

    langchain-ai langchain-ai/langchain open-webui open-webui-compat Wolfi PyPI
  • High 8.4
    CVE-2025-2828 EPSS 21%

    SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain

    A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vul…

    langchain-ai langchain-ai/langchain langchain-community PyPI
  • Medium 4.9
    CVE-2024-8309 Public exploit EPSS 14%

    SQL Injection in langchain-ai/langchain

    A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting al…

    langchain-ai langchain-ai/langchain langchain langchain-community PyPI
  • Medium 5.2
    CVE-2024-5998

    Deserialization of Untrusted Data in langchain-ai/langchain

    A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version o…

    langchain-ai langchain-ai/langchain langchain langchain-community PyPI
  • Medium 4.2
    CVE-2024-2965

    Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain

    A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infi…

    langchain-ai langchain-ai/langchain langchain langchain-community PyPI
  • Medium 4.8
    CVE-2024-3095 Public exploit

    SSRF in Langchain Web Research Retriever in langchain-ai/langchain

    A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, all…

    langchain-ai langchain-ai/langchain langchain-community PyPI
  • Medium 6.3
    CVE-2024-2057 Public exploit

    LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

    A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation …

    @langchain langchain_community langchain-community PyPI