Skip to content
OpenAdvisories

Vendor

langchain-ai

55 known vulnerabilities.

Products

langchain-ai/langchain 12 langgraph 11 langchain 8 langsmith-sdk 5 langchainjs 5 langgraph-api 3 langgraphjs 2 langgraph-checkpoint-sqlite 2 langgraph-checkpoint-postgres 2 langchain-ai/langchainjs 2 helm 1 langchain-ai 1 langchain-sdk 1 langchain-openai 1 langchain-anthropic 1 langchain-mongodb 1 langgraph-checkpoint-mongodb 1 langgraph-store-mongodb 1 langraph-checkpoint 1 langgraph-sdk 1 langchain-text-splitters 1 langgraph-checkpoint 1 langchain-community 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.7
    CVE-2026-48121 Public exploit

    @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

    @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from con…

    langchain-ai langgraphjs @langchain/langgraph-checkpoint-mongodb npm
  • Medium 4.9
    CVE-2024-8309 Public exploit EPSS 14%

    SQL Injection in langchain-ai/langchain

    A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting al…

    langchain-ai langchain-ai/langchain langchain langchain-community PyPI
  • Medium 4.8
    CVE-2024-3095 Public exploit

    SSRF in Langchain Web Research Retriever in langchain-ai/langchain

    A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, all…

    langchain-ai langchain-ai/langchain langchain-community PyPI