langgrinch-cve-2025-68664-analysis

Análisis de Vulnerabilidad LangGrinch: CVE-2025-68664 Resumen Este repositorio contiene un informe técnico que analiza CVE-2025-68664, también conocido como LangGrinch, una vulnerabilidad de inyección de serialización que afecta a LangChain Core. El informe explica los antecedentes de la...

CVE-2025-68664-LangGrinch-PoC

📑 Índice 🎯 Resumen Ejecutivo 📂 Estructura del Proyecto 🚀 Inicio Rápido...

Nmap-API

API de Nmap Usa python3.10, Debian, python-Nmap y el framework flask para crear una API de Nmap que puede realizar escaneos con buena velocidad en línea y es fácil de desplegar. Esta es una implementación para nuestro proyecto universitario PCL que aún está en desarrollo y se actualiza...

LangAlpha

Un arnés de agente para inversiones por vibra «vibe investing» LangAlpha está diseñado para ayudar a interpretar los mercados financieros y respaldar decisiones de inversión. English ｜ 简体中文 ｜ 日本語 Primeros pasos • API Docs • Agent Core • Backend • Web • TUI • Skills • MCP Fija en el panel un resum...

Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Resumen Este proyecto demuestra la vulnerabilidad CVE-2024-21513 en el paquete langchain-experimental, específicamente en las versiones =0.0.15 y 0.0.21. La vulnerabilidad permite la ejecución de código arbitrario a través del componente VectorSQLDatabaseChain al recupera...

CVE-2024-8309

Langchain CVE-2024–8309 भेद्यता के लिए प्रूफ ऑफ कॉन्सेप्ट अवलोकन यह सेटअप GraphCypherQAChain क्लास में प्रॉम्प्ट इंजेक्शन भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट प्रदर्शित करता है, जो Neo4j डेटाबेस में SQL इंजेक्शन की अनुमति देता है। घटक: 1. Neo4j डेटाबेस : Neo4j चलाता है। 2. बैकएंड FastAPI :...

CVE-2026-34070

I Found a Path Traversal Bug in LangChain That Could Leak Your Cloud Credentials How a forgotten legacy API in one of AI's most popular frameworks quietly exposed millions of applications to arbitrary file reads. There's a certain feeling you get when a proof-of-concept works on the first try. No...

CVE-2024-21513

CVE-2024-21513 PoC para CVE-2024-21513 Exploit original documentado por Snyk Security Research Exploit CVE-2024-21513 es una vulnerabilidad en langchain-experimental donde los resultados no validados de consultas SQL se pasaban a eval de Python, permitiendo la ejecución remota de código mediante...

LangAlpha v2026.09.01

A vibe investing agent harness LangAlpha is built to help interpret financial markets and support investment decisions. English ｜ 简体中文 ｜ 日本語 Getting Started • API Docs • Agent Core • Backend • Web • TUI • Skills • MCP Pin a curated news brief from the dashboard, kick off idea generation, and...

CVE-2025-68664

CVE-2025-68664 All I Want for Christmas Is Your Secrets: LangGrinch Strikes LangChain Core CVE-2025-68664 Author: Yarden Porat Cyata Research: LangGrinch Vulnerability in LangChain Published: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Yesterday LangChain published a critical...

ROOT-APP-PYPI-CVE-2026-34070 CVE-2026-34070 in langchain-core - Patched by Root

Root has patched CVE-2026-34070 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44843 CVE-2026-44843 in langchain-core - Patched by Root

Root has patched CVE-2026-44843 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-65106 CVE-2025-65106 in langchain-core - Patched by Root

Root has patched CVE-2025-65106 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-68664 CVE-2025-68664 in langchain-core - Patched by Root

Root has patched CVE-2025-68664 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

CVE-2026-72848

A flaw was found in langchain-community. An attacker who controls or influences an ingested sitemap can bypass domain restrictions in the SitemapLoader component by pointing a nested sitemap entry at an internal address. This allows the server to fetch internal resources even when...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +2041 more potentially affected by CVE-2026-72848 via langchain-community (>=0.0.1, <=1.0.0a1)

langchain-community PYPI version =0.0.1, =0.1.0, =0.1.0b1, =0.1.0, =0.1.0, =0.1.0, =4.8.2, =0.1.3, =0.1.0, =1.0.1, =0.1.0, =0.1.0, =3.2.0, =3.4.0 and more Source cves: CVE-2026-72848 Source advisory: SNYK:PYTHON-LANGCHAINCOMMUNITY-19233333...

CVE-2026-72848

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848

CVE-2026-72848 is a Server-Side Request Forgery (SSRF) in langchain_community 's SitemapLoader.parse_sitemap (document_loaders/sitemap.py). The restrict_to_same_domain guard is applied only to leaf URL entries; nested sitemap index entries bypass it entirely, passing the child loc directly to Web...