Skip to content
OpenAdvisories

Package · PyPI

langchain

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.1
    CVE-2026-45134

    LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

    LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) …

    langchain-ai langsmith-sdk open-webui langfuse-3-worker Wolfi npm PyPI
  • High 8.1
    CVE-2024-28088 Public exploit

    LangChain directory traversal vulnerability

    LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub re…

    langchain langchain-core PyPI
  • High 7.5
    CVE-2023-32786

    Langchain Server-Side Request Forgery vulnerability

    In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

    langchain PyPI
  • High 8.8
    CVE-2023-46229 Public exploit EPSS 42%

    LangChain Server Side Request Forgery vulnerability

    LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

    langchain PyPI
  • High 7.5
    CVE-2023-36189

    langchain SQL Injection vulnerability

    SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.

    langchain PyPI