Skip to content
OpenAdvisories

Package · PyPI

langchain-core

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.2
    CVE-2026-44843

    LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists

    LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allo…

    langchain-ai langchain langchain-core PyPI
  • High 7.5
    CVE-2026-34070 Public exploit

    LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

    LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal…

    langchain-ai langchain langchain-core PyPI
  • High 8.3
    CVE-2025-65106

    LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

    LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object interna…

    langchain-ai langchain open-webui open-webui-compat Wolfi PyPI
  • High 8.1
    CVE-2024-28088 Public exploit

    LangChain directory traversal vulnerability

    LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub re…

    langchain langchain-core PyPI