Skip to content
OpenAdvisories

Vendor

@langchain

3 known vulnerabilities.

Products

langchain_community 1 redis 1 mongodb 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.0
    CVE-2026-106119

    LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

    LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a Mon…

    langchain-ai @langchain langchainjs mongodb npm
  • Medium 6.3
    CVE-2024-2057

    LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgery

    A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation …

    @langchain langchain_community langchain-community PyPI