Skip to content
OpenAdvisories

Product · langchain-ai

langchainjs

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.0
    CVE-2026-106119

    LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

    LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a Mon…

    langchain-ai @langchain langchainjs mongodb npm
  • Medium 4.1
    CVE-2026-27795

    LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

    LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the un…

    langchain-ai langchainjs @langchain/community npm
  • Medium 4.1
    CVE-2026-26019

    @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

    LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intend…

    langchain-ai langchainjs @langchain/community npm